18.9.26.(1:4).1 - Type is string about windows-2019-cis HOT 3 CLOSED

18.9.26.1.1 EventLog\Application
18.9.26.2.1 EventLog\Security
18.9.26.3.1 EventLog\Setup
18.9.26.4.1 EventLog\System

from windows-2019-cis.

@Pfenris,
Thanks for pointing that out and you might be right. However I want to make sure before implementing the change. The CIS controls have you checking/using HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\EventLog\Application:Retention. The documentation for the HKLM/SOFTWARE path to the event log has those as string values.

However the documentation you have linked does have it as a dword entry but that is for the HKLM\SYSTEM path to the event log settings. Being more of a Linux person I'm not sure of the answer to this off the top of my head, so I'm going to do a bit of research into this path being a system or software path. I know the benchmarks have had some incorrect items in them before so I'm not 100% sold CIS has it correct, so I'm going to confirm.

-George

from windows-2019-cis.

@georgenalen
I am going to close this out. While string passed the compliance check dword has some rather unpleasant impacts on production. I am closing this out I don't recommend proceeding with dword at this time.

from windows-2019-cis.