Ensure 'Configure registry policy processing: Do not apply during periodic background processing' is set to 'Enabled: FALSE'

ÉlevéeNiveau 1Automatiséewindows

Description

The "Do not apply during periodic background processing" option prevents the system from updating affected registry policies in the background while the computer is in use. When background updates are disabled, registry policy changes will not take effect until the next user logon or system restart. This setting affects all policy settings within the Administrative Templates folder and any other policies that store values in the registry. The recommended state for this setting is: Enabled: FALSE (unchecked).

Méthode de vérification

Méthode d'audit: Registre Windows

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}' -Name 'NoBackgroundPolicy' -ErrorAction SilentlyContinue).'NoBackgroundPolicy'; if (-not ($null -ne $v -and @(0) -contains [int64]$v)) { $bad += 'NoBackgroundPolicy=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Commande shell

shell

if (-not (Test-Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}')) { New-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}' -Force | Out-Null }; New-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2}' -Name 'NoBackgroundPolicy' -Value 0 -PropertyType DWord -Force | Out-Null

Propriétés

Systèmes d'exploitation: windows-10
Étiquettes: cis-convertedregistrywindows
Référence: CIS Microsoft Windows 10 Enterprise Benchmark v4.0.0 - 18.9.19.2

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target windows