Examples/CIS_Microsoft_Windows_10_Enterprise_Release_2004_With_LAPS.ps1
|
#Requires -module CISDSC <# .DESCRIPTION Applies CIS Level one benchmarks for Windows 10 build 2004 with the non-standard services excluded. This will also install LAPS (Local Administrator Password Solution) from the internet via download.microsoft.com unless the URL is changed to a network accesible path for your envrionment. #> Configuration Win10_2004_L1_With_LAPS { Import-DSCResource -ModuleName 'PSDesiredStateConfiguration' Import-DSCResource -ModuleName 'CISDSC' -Name 'CIS_Microsoft_Windows_10_Enterprise_Release_2004' node 'localhost' { Package 'InstallLAPS' { Name = 'Local Administrator Password Solution' Path = 'https://download.microsoft.com/download/C/7/A/C7AAD914-A8A6-4904-88A1-29E657445D03/LAPS.x64.msi' ProductId = 'EA8CB806-C109-4700-96B4-F1F268E5036C' } CIS_Microsoft_Windows_10_Enterprise_Release_2004 'CIS Benchmarks' { 'ExcludeList' = @( '5.6', # IIS Admin Service (IISADMIN) '5.7', # Infrared monitor service (irmon) '5.10',# LxssManager (LxssManager) '5.11',# Microsoft FTP Service (FTPSVC) '5.13',# OpenSSH SSH Server (sshd) '5.27',# Simple TCP/IP Services (simptcp) '5.29',# Special Administration Console Helper (sacsvr) '5.32',# Web Management Service (WMSvc) '5.40' # World Wide Web Publishing Service (W3SVC) ) '2315AccountsRenameadministratoraccount' = 'CISAdmin' '2316AccountsRenameguestaccount' = 'CISGuest' '2376LegalNoticeCaption' = 'Legal Notice' '2375LegalNoticeText' = @" This is a super secure device that we don't want bad people using. I'm even making sure to put this as a literal string so that I can cleanly use multiple lines to tell you how super secure it is. "@ 'DependsOn' = '[Package]InstallLAPS' } } } Win10_2004_L1_With_LAPS Start-DscConfiguration -Path '.\Win10_2004_L1_With_LAPS'-Verbose -Wait |