Walkthrough: Creating a compliance template

Using the Component Templates folder in BSA, navigate to a location where you want to create a component template. Right-click and select New > Component Template. A wizard opens that guides you through the process of creating a component template.

On the General panel of the wizard, enter a name for the template. Then select the type of operations you want to allow for this component template. In this example, we select Discover, Browse, Compliance, and Allow Remediation. Finally, click Finish.

Later, you add more complex information to the component template during an editing process.

Assign parts to the component template.

1. Click the Parts tab.
2. Click the Add Part icon . The Select Parts dialog opens.
3. Navigate to the type of server for which you want to test compliance. In this case, we select a server running Windows 2008.
4. Expand the server to see all the server object types available on that machine.
   When selecting parts for a component template, you can use any of these server object types or the individual objects they contain.  
5. Expand Security Settings, expand Account Policies, and then expand Password Policy.
6. Select Enforce password history and Maximum password age and move them to the New Parts list at right.
7. Click OK.
   The parts you have selected appear in the list on the Parts tab. 

Component template parts often include a wide variety of server objects. To keep this walkthrough simple, we selected only two parts.

Set up a rule group and begin to define the first rule.

1. Click the Compliance tab.
2. Create a compliance rule group by clicking the Add New Rule Group icon . Assign a name to the rule group. In this case we call the group Password Compliance.
3. Select the newly created compliance rule group and click the Add New Compliance Rule icon . The New Rule tab appears. It has three sub-tabs, displayed at the bottom of the pane.
4. Assign a name to the rule. In this case we call it Maximum password age. Optionally, provide a description.

Click the Rule Definition sub-tab and define the contents of the first rule.

1. To define the first condition of the rule, click the New Condition icon and take the following steps:
   1. In the first drop-down box, click the drop-down arrow, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Maximum password age and select Effective setting as String Value (Windows).
   2. In the next drop-down select does not equal. Then leave the next field empty.
   3. In the last drop-down on the row select AND.
2. Click New Condition to start another condition:
   1. In the first drop-down, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Maximum password age and select Local setting as String Value (Windows).
   2. In the next drop-down select does not equal and leave the next field empty.
   3. In the last drop-down on the row select AND.
3. Click New Condition to start another condition:
   1. In the first drop-down, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Maximum password age and select Effective setting as Integer Value (Windows).
   2. In the next drop-down select between.
   3. In the next two fields enter 1 and 60. This means you must change your password at least every 60 days.
   4. In the last drop-down on the row select AND.
4. Click New Condition to start the last condition:
   1. In the first drop-down, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Maximum password age, and select Local setting as Integer Value (Windows).
   2. In the next drop-down select between.
   3. In the next two fields enter 1 and 60.
   4. In the last drop-down on the row select AND.
5. Click Apply Condition Value, save your edits (Ctrl+S), and close the tab defining this rule.

Taken together, these rules say that there must be a value for password age and that the password must be between no older than 60 days.

Note: These rules are set up to test both the local setting and the effective setting. The local setting is the setting established on a server by means of its local security policy or registry setting. The effective setting is the setting that is actually in effect. They can differ if a server is part of a Windows domain and the domain level group policy object (GPO) overrides the local setting. Local and effective settings can also differ if the local setting has been changed but is not yet in effect. For example, the server may be in need of a reboot to apply a changed setting. BMC recommends setting up compliance rules to test both the local and effective setting.

Defining first condition

Logical descriptions of all conditions

Create a new rule.

1. Select the existing compliance rule group (in this example it is called Password Compliance) and click Add New Compliance Rule .
2. Assign a name to the rule. We call this rule Password history. Optionally, you can provide a description.

Click the Rule Definition sub-tab and define the contents of the next rule.

1. Click New Condition and take the following steps:
   1. In the first drop-down box, click the drop-down arrow, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Enforce password history, and select Effective setting as String Value (Windows).
   2. In the next drop-down select does not equal and then leave the next field empty.
   3. In the last drop-down on the row select AND.
2. Click New Condition to start another condition:
   1. In the first drop-down, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Enforce password history, and select Local setting as String Value (Windows).
   2. In the next drop-down select does not equal and then leave the next field empty.
   3. In the last drop-down on the row select AND.
3. Click New Condition to start another condition:
   1. In the first drop-down, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Enforce password history, and select Effective setting as Integer Value (Windows).
   2. In the next drop-down select greater than or equal to.
   3. In the next field enter 24. This means you cannot reuse any of your last 24 passwords.
   4. In the last drop-down on the row select AND.
4. Click New Condition to start the last condition:
   1. In the first drop-down, expand Configuration Objects, expand Security Setting:Security Settings\Account Policies\Password Policy\Enforce password history, and select Local setting as Integer Value (Windows).
   2. In the next drop-down select greater than or equal to.
   3. In the next field enter 24.
   4. In the last drop-down on the row select AND.
5. Click Apply Condition Value, save your edits (Ctrl+S), and close the tab defining this rule.
6. Close the tab for the component template. You are prompted to save any changes. The component template is complete.

Taken together, these rules say that there must be a value for password history and that the user cannot reuse any of his last 24 passwords.