Add/Modify LTSC Checks

[njohnson11]

A number of controls whose descriptions mention being NA for LTSC/B systems, are either not checking this or are checking in a way that misses new LTSC versions. The following controls need to be addressed.

• 63349 - V3R2 Control SV-220706
• 63659 - V3R2 Control SV-220825
• 63699 - V3R2 Control SV-220840
• 63701 - V3R2 Control SV-220841
• 63709 - V3R2 Control SV-220843
• 63713 - V3R2 Control SV-220844
• 82139 - V3R2 Control SV-220842

[njohnson11]

Note: I developed the following inspec commands to check if a system is LTSC or not, however there is likely a cleaner way. Thoughts?

is_ltsc = command('gwmi win32_operatingsystem | select OperatingSystemSKU').stdout.split[-1].strip.to_i >= 123

is_ltsc = command('systeminfo | findstr /B /C:"OS Name"').stdout.include?("LTS")

This seems like the fastest to check
is_ltsc = os.name.downcase.include?("lts")

is_ltsc = registry_key('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion')["ProductName"].downcase.include?("lts")

[aaronlippold]

Why not just use the os resource ?

…

On Mon, Apr 5, 2021, 4:51 PM njohnson11 ***@***.***> wrote: Note: I developed the following inspec commands to check if a system is LTSC or not, however there is likely a cleaner way. Thoughts? is_ltsc = command('gwmi win32_operatingsystem | select OperatingSystemSKU').stdout.split[-1].strip.to_i >= 123 is_ltsc = command('systeminfo | findstr /B /C:"OS Name"').stdout.include?("LTS") is_ltsc = os.name.downcase.include?("lts") is_ltsc = registry_key('HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion')["ProductName"].downcase.include?("lts") — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#21 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AALK42FE3H2H5PK567BYPKLTHIPGDANCNFSM42NNCTVQ> .

[njohnson11]

That one seemed the cleanest. The first one is a better bet for working against IoT versions but the os name one would likely work as well.