SCA Windows 10 Benchmark not working as expected no Windows 10 Professional

[Jon Sereda]

Hello Team,

I'm a new Wazuh users and currently trying out the SCA feature.  

In doing so I've setup a Windows 10 Professional Workstation and applied a large number of GPO's which should satisfy many of the default SCA tests.  

A good number of them do pass the scan test.  However, there appear to be many that fail even though they are met.  

For example the following check fails even though it is satisfied on the Agent.  : 

Ensure 'Network security: LAN Manager authentication level' is set to 'Send NTLMv2 response only. Refuse LM & NTLM'.

Checks (Condition: all)
r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa -> LmCompatibilityLevel
r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa -> LmCompatibilityLevel -> 5

The default benchmark is "CIS Microsoft Windows 10 Enterprise Benchmark v1.12.0".  

If the problem being a slight difference in the Operating System?  

[Jon Sereda]

Hi, I just want to know if these policies should work "Out of the box" for the version mentioned or do they require additional configuration to work as expected?  
Thanks

[Jon Sereda]

I've found almost the same exact question on another chat.  

https://www.reddit.com/r/Wazuh/comments/16vhqzb/sca_rules_false_negatives/

In this case (and my case for this single example) there is an extra space in the yml file on line 946 after LmCompatibilityLevel... 

• 'r:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa -> LmCompatibilityLevel '

I would now like to repair this and others that I discover on the rest of the file that is shared out to clients by default.  

What would be the best way to accomplish this?  

[Federico Rodriguez]

Hi Jon Sereda, hope you are doing well. 

The extra space issue has been addressed in this pull request for Wazuh 4.8.0, which will be released very soon.

https://github.com/wazuh/wazuh/pull/19515

I'm very sorry for the delay in the answer, let me know if this helps you.