Updating PCI for Windows 2016 to newer benchmarks
This document provides information about the hotfix containing Payment Card Industry (PCI) version 3.2.1 templates for Windows Server 2016, with implementation for 162 rules that can be installed on TrueSight Server Automation 8.9.00 onwards. This template is created based on the recommended settings defined by Microsoft Windows Server 2016 Security Configuration Benchmark Version 3.2.1, published on May 2018.
Before you begin
Before you install this hotfix, ensure that all compliance content provided by BMC in your environment is at least updated to version 8.9.
Step 1: Downloading and installing the files
Login to ftp.bmc.com host using SFTP protocol. Download the PCI - Windows Server 2016.zip and extended_objects.zip package from the following location:
Click here to expand checksum related infromation
Verify the downloaded content by using the following check sums.
PCI - Windows Server 2016.zip
Verify the extended objects present on the application. If the md5sums match, go ahead and replace them. If these md5sums do not match, you must manually merge the fixes.
Extended Objects shipped with this template (part of extended_objects.zip)
- Move the PCI - Windows Server 2016.zip package to your RCP client server.
Step 2: Replacing the extended object scripts on the file server
- Navigate to the extended objects script files on your file server:
- Replace the Extended Object script files on your file server, with the extracted Extended Object script files stored in the temporary location:
Step 3: Importing the Compliance Content
- Log on to the Console.
- Right-click Component Templates and select Import.
The Import Wizard starts.
- Select the Import (Version-neutral) option.
- Select the PCI - Windows Server 2016.zip package from the temporary location and click Next.
The PCI template for PCI - Windows Server 2016 is available in the PCI - Windows Server 2016.zip package. To import the templates, select the zip file and click Next.
Ensure that you select the Update objects according to the imported package and Preserve template group path options before you click Next.
Navigate to the last screen of the wizard and then click Finish.
The templates are imported successfully.
Rules within the templates
The following are the details of the 162 rules provided in the zip package. It contains the following types of rules:
- Rules that check for compliance and provides remediation - 111
- Rules that check for compliance but do not provide remediation - 2
- Rules that must be manually checked - 49
The following table lists the number of rules for each section:
Total number of rules
Ensure that you have gone through the following points before you run the compliance checks or perform remediation:
- While running compliance jobs on domain controller targets, set the target server's DOMAIN property to DC.
- Leave DOMAIN property blank for member servers and standalone systems.
Rule IDs that must be checked manually
10.1 , 10.2.3 , 10.2.4 , 10.2.5 , 10.2.6 , 10.2.7 , 10.3.1 , 10.3.2 , 10.3.3 , 10.3.4 , 10.3.5 , 10.3.6 , 10.4 , 10.4.1 , 10.4.2 , 10.4.3 , 10.5.1 , 10.5.2 , 10.5.3 , 10.5.4 , 10.7
8.1.1 , 8.1.2 , 8.1.3 , 8.1.5 , 8.2.1 , 8.2.2 , 8.2.6 , 8.4 , 8.5.1 , 8.6 , 8.7
7.1.1 , 7.1.2 , 7.1.3 , 7.1.4 , 7.2.1 , 7.2.2 , 7.2.3
6.1 , 6.2
5.1 , 5.2 , 5.3
2.1 , 2.2.1 , 2.2.2 , 2.2.3 , 2.3
RULE IS WHICH PROPERTY IS USED