1

I want to check if is screensaver on my Windows 10 Pro active using my own PowerShell-script and OpenSCAP 1.3.2 (Windows version). I wrote such file test.xml:

<?xml version="1.0" encoding="UTF-8"?>
<Benchmark
  xmlns="http://checklists.nist.gov/xccdf/1.1"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  id="RHEL-7"
  resolved="0"
  xml:lang="en-US">

  <status date="2011-12-08">draft</status>
  <title>Test XCCDF Benchmark</title>
  <version>0.1</version>

  <Profile id="standard">
    <title>Standard System Security Profile</title>
    <select idref="Screensaver_Is_Active" selected="true"/>
  </Profile>

  <Group id="password_requirements">
    <title>Active Screensaver Test</title>

    <Rule id="Screensaver_Is_Active" selected="false" severity="medium" weight="10.000000">
       <title>Check if screensaver is active?</title>
       <description>
          <xhtml:pre xmlns:xhtml="http://www.w3.org/1999/xhtml">Check screensaver</xhtml:pre>
       </description>
       <check system="http://open-scap.org/page/SCE">
          <check-import import-name="stdout" />
          <check-content-ref href="test.ps1" />
       </check>
    </Rule>

  </Group>
</Benchmark>

and test.ps1

$data = Get-ItemProperty -Path "HKCU:\Control Panel\Desktop"
if ($data.ScreenSaveActive) {
    Write-Output "Passed"
    exit $XCCDF_RESULT_PASS
} else { 
    Write-Output "Failed"
    exit $XCCDF_RESULT_FAIL
}

Then I start check using command and have "notchecked" responce:

PS C:\> oscap xccdf eval --profile standard test.xml
Title
    Check if screensaver is active?
Rule    Screensaver_Is_Active
Result  notchecked

Files test.ps1 and test.xml are also on the path 'C:\'

What's wrong in my example? Why check has only "notchecked" status?

1 Answer 1

0

First try using oscap with the option so we can have more information on what's is going on. INFO level should be fine:

--verbose <verbosity_level>   - Turn on verbose mode at specified verbosity level.
                                   Verbosity level must be one of: DEVEL, INFO, WARNING, ERROR.

But I'm not sure if SCE modules are available for Windows.

Also try running oscap --version and check if there are capabilities listed under:

==== Capabilities added by auto-loaded plugins ====
4
  • also I tried to investigate how to enable SCE at Windows. I installed OpenSCAP on my Ubuntu, run oscap -V and see under row ==== Capabilities added by auto-loaded plugins ==== SCE Version: 1.0 (from libopenscap_sce.so.8). But in Windows it is empty. May be you know how to enable SCE in Windows version of OpenSCAP? Feb 17, 2020 at 8:29
  • It seems SCE plugin is disabled. I run command with --verbose INFO and in response I've found this C:\Program Files (x86)\OpenSCAP 1.3.2\oscap.exe: This rule requires a SCE check but the SCE plugin was disabled. Feb 17, 2020 at 8:34
  • Unfortunately currently SCE plugin is not enabled/built for Windows/Mac. Probably it doesn't work and would need to be updated. I just verified that is disabled from here where the build happens: ci.appveyor.com/project/OpenSCAP/openscap/branch/master#L152
    – Becker
    Feb 17, 2020 at 10:18
  • We use OpenSCAP and want to run some our custom scripts for Windows-based servers. May be you can enable SCE in Windows-build if it is possible? Is it possible for us to do this on our own and how we can do it? Feb 17, 2020 at 11:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .