Preface: I am a Linux admin. I don't really "get" (or like) Windows.
I am in the process of remediating Windows 2016 servers with the CIS recommendations. It is mostly just creating a GPO set according to CIS specs, and applying it to the server(s) in question. I'm using Tenable's Nessus Audit Scanner to check the validity of the settings.
Here is where you can get the CIS spec I am using: https://www.cisecurity.org/benchmark/microsoft_windows_server/
(There isn't a direct download for it but it is free to download.)
Many of the exact details don't matter, so for this question I will focus on one specific example that I should be able to extrapolate to resolve the other problems. Broadly, the problem seems to be that I am trying to apply Registry edits via GPO and I guess I don't understand how to do that. However, the CIS guideline is very specific on the steps to remediate.
So, for example, I'm trying to apply CIS guideline 188.8.131.52, "Ensure 'Enable screen saver' is set to 'Enabled'"
The steps to do this are listed as:
To establish the recommended configuration via GP, set the following UI path to Enabled: User Configuration\Policies\Administrative Templates\Control Panel\Personalization\Enable screen saver
Ok, so, I did that. I know the GPO itself is applied because all the other GPO settings now show up on the server. Also, the Nessus Audit Scan now shows "OK" for most of the items I just applied.
The only items that don't seem to work are items that are Registry settings.
When I examine the Registry, I see the key I'm trying to set to a value isn't even there. For this example, that key is:
HKEY_USERS[USER SID]\SOFTWARE\Policies\Microsoft\Windows\Control Panel\Desktop:ScreenSaveActive
So, how do I get a Registry setting to show up via GPO?
Specifically, how do I make "User Configuration" Registry items show up?