I am trying to audit and enforce stig rules using the PowerSTIG module which uses the PowerShell desired State Configuration to achieve the same.
I am following the steps given in the below link to apply a single stig rule (windows server) and trying to audit it.
https://github.com/Microsoft/PowerStig/wiki/GettingStarted#audit-servers
As given in the documentation,i have copied the organizational settings file to a central location and referencing in my resource script. My Configuration script looks like this:
<span class="typ">Configuration</span> <span class="typ">TestConfig</span>
<span class="pun">{</span>
<span class="com"># It is best practice to always directly import resources, even if the resource is a built-in resource.</span>
<span class="typ">Import</span><span class="pun">-</span><span class="typ">DscResource</span> <span class="pun">-</span><span class="typ">ModuleName</span> <span class="typ">PowerStig</span>
<span class="typ">Import</span><span class="pun">-</span><span class="typ">DSCResource</span> <span class="pun">-</span><span class="typ">Name</span> <span class="typ">WindowsServer</span>
<span class="typ">Node</span><span class="pln"> localhost
</span><span class="pun">{</span>
<span class="com"># The name of this resource block, can be anything you choose, as long as it is of type [String] as indicated by the schema.</span>
<span class="typ">WindowsServer</span> <span class="typ">STIGBaseLine</span>
<span class="pun">{</span>
<span class="typ">OsVersion</span> <span class="pun">=</span> <span class="str">'2012R2'</span>
<span class="typ">OsRole</span> <span class="pun">=</span> <span class="str">'MS'</span>
<span class="typ">StigVersion</span> <span class="pun">=</span> <span class="str">'2.13'</span>
<span class="typ">OrgSettings</span> <span class="pun">=</span> <span class="str">"C:\Scripts\Windows-2012R2-MS-2.12.xml"</span>
<span class="pun">}</span>
<span class="pun">}</span>
<span class="pun">}</span>
I am using . C:\Scripts\TestConfig command to compile the configuration file and it is compliling without throwing any error. After that i am executing ‘TestConfig’ command to generate the local MOF. At that point I’m getting the following error:
<span class="typ">PSDesiredStateConfiguration</span><span class="pln">\Configuration </span><span class="pun">:</span> <span class="typ">Organizational</span><span class="pln"> file not found
</span><span class="typ">At</span><span class="pln"> C</span><span class="pun">:</span><span class="pln">\Program </span><span class="typ">Files</span><span class="pln">\WindowsPowerShell\Modules\PowerSTIG\2</span><span class="pun">.</span><span class="lit">4.0</span><span class="pun">.</span><span class="lit">0</span><span class="pln">\D</span><span class="typ">SCResources</span><span class="pln">\WindowsServer\WindowsServer</span><span class="pun">.</span><span class="pln">schema</span><span class="pun">.</span><span class="pln">psm1</span><span class="pun">:</span><span class="lit">48</span><span class="pln"> char</span><span class="pun">:</span><span class="lit">1</span>
<span class="pun">+</span> <span class="typ">Configuration</span> <span class="typ">WindowsServer</span>
<span class="pun">+</span> <span class="pun">~~~~~~~~~~~~~~~~~~~~~~~~~~~</span>
<span class="pun">+</span> <span class="typ">CategoryInfo</span> <span class="pun">:</span> <span class="typ">NotSpecified</span><span class="pun">:</span> <span class="pun">(:)</span> <span class="pun">[</span><span class="typ">Configuration</span><span class="pun">],</span> <span class="typ">ParentContainsErrorRecordException</span>
<span class="pun">+</span> <span class="typ">FullyQualifiedErrorId</span> <span class="pun">:</span> <span class="typ">RuntimeException</span><span class="pun">,</span><span class="typ">Configuration</span>
<span class="typ">Compilation</span><span class="pln"> errors occurred </span><span class="kwd">while</span><span class="pln"> processing configuration </span><span class="str">'TestConfig'</span><span class="pun">.</span> <span class="typ">Please</span><span class="pln"> review the errors reported </span><span class="kwd">in</span><span class="pln"> error stream and modify your configuration code appropriately</span><span class="pun">.</span>
<span class="typ">At</span><span class="pln"> C</span><span class="pun">:</span><span class="pln">\WINDOWS\system32\WindowsPowerShell\v</span><span class="lit">1.0</span><span class="pln">\Modules\P</span><span class="typ">SDesiredStateConfiguration</span><span class="pln">\P</span><span class="typ">SDesiredStateConfiguration</span><span class="pun">.</span><span class="pln">psm1</span><span class="pun">:</span><span class="lit">3917</span><span class="pln"> char</span><span class="pun">:</span><span class="lit">5</span>
<span class="pun">+</span><span class="pln"> throw $ErrorRecord
</span><span class="pun">+</span> <span class="pun">~~~~~~~~~~~~~~~~~~</span>
<span class="pun">+</span> <span class="typ">CategoryInfo</span> <span class="pun">:</span> <span class="typ">InvalidOperation</span><span class="pun">:</span> <span class="pun">(</span><span class="typ">TestConfig</span><span class="pun">:</span><span class="typ">String</span><span class="pun">)</span> <span class="pun">[],</span> <span class="typ">InvalidOperationException</span>
<span class="pun">+</span> <span class="typ">FullyQualifiedErrorId</span> <span class="pun">:</span> <span class="typ">FailToProcessConfiguration
</span>I’m not sure whether i have to modify the WindowsServer.Schema.psm1 to define the orgsettings or define the orgsettings path somewhere inside the PowerStig module. In the Getting Started Guide they have not mentioned anything about setting the orgsetting variable inside the module.
Can anyone help me resolve the isssue?