Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue with AuditTAP When Changing PowerShell Security Rule to ConstrainedLanguage #568

Open
PfeilImKopf opened this issue Apr 29, 2024 · 1 comment
Labels
bug Something isn't working

Comments

@PfeilImKopf
Copy link
Collaborator

Operating System

Windows 10

Report Name

Microsoft Windows 10

Benchmark and ID (OPTIONAL)

Security Base Data : SBD-025

What happened?

  1. When the LanguageMode of PowerShell ist set to ConstrainedLanguage, the ATAP is not executable! The Import of the modules throws multiple errors
    20240426_222231
  2. The check on the languageMode is testing on the string "Constrained Language" instead of "ConstrainedLanguage". Not important if the ATAP is not being executable because of this rule

What did you expect?

ATAP starting as intended! giving proper feedback about this configuration

Current Version?

I used the latest official release.

@PfeilImKopf PfeilImKopf added the bug Something isn't working label Apr 29, 2024
@TuemmlerKelch TuemmlerKelch changed the title [Bug]: Issue with AuditTAP When Changing PowerShell Security Rule to ConstrainedLanguage Issue with AuditTAP When Changing PowerShell Security Rule to ConstrainedLanguage Apr 29, 2024
@TuemmlerKelch
Copy link
Collaborator

Please implement the following if possible:

  1. Add a check for language mode
  2. If constrained language mode, inform the user about that fact and inform that ATAP requires FullLanguage mode. Ask if user wants to activate FullLanguage over the course of ATAP being executed
    2.1 If user allows FullLanguage continue
    2.2 If user does not allow, cancel script with necessary information
  3. After ATAP has finished, revert back to whatever Language mode was active beforehands

If changing back and forth is not possible, just end script informing user that ATAP requires Full Language and needs to be configured appropriately if user desires to utilize ATAP

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants