52 lines
1.6 KiB
Puppet
52 lines
1.6 KiB
Puppet
class profile::compliance::hipaa::windows {
|
|
|
|
# HIPAA Administrative Simplification Regulation Text
|
|
# https://www.hhs.gov/sites/default/files/hipaa-simplification-201303.pdf?language=es
|
|
|
|
# 164.312 Technical safeguards
|
|
# (i) Unique user identification (Required)
|
|
|
|
# Ensure only known accounts are on the system, purge any unmanaged accounts otherwise.
|
|
user { 'Local Admin 1':
|
|
ensure => present,
|
|
groups => ['Administrators'],
|
|
}
|
|
|
|
user { 'Local Admin 2':
|
|
ensure => present,
|
|
groups => ['Administrators'],
|
|
}
|
|
|
|
#Purge any unmanaged users.
|
|
purge { 'user':
|
|
unless => [
|
|
[ 'name', '==', 'Administrator' ],
|
|
[ 'name', '==', 'Guest' ],
|
|
[ 'name', '==', 'Local Admin 1' ],
|
|
[ 'name', '==', 'Local Admin 2' ],
|
|
]
|
|
}
|
|
|
|
# (iii) Automatic logoff (Addressable)
|
|
# NOTE: Local Group Policy Editor tool does not show these settings as 'Enabled' but they do work.
|
|
|
|
# Set time limit for active but idle Remote Desktop Services sessions: 10 minutes
|
|
registry_value { 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services\MaxIdleTime':
|
|
type => dword,
|
|
data => '0x000927c0',
|
|
notify => Reboot['after_run'],
|
|
}
|
|
|
|
# Set time limit for disconnected sessions: 5 minutes
|
|
registry_value { 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services\MaxDisconnectionTime':
|
|
type => dword,
|
|
data => '0x000493e0',
|
|
notify => Reboot['after_run'],
|
|
}
|
|
|
|
# Reboot is required for registry keys above if they are remediated/altered.
|
|
reboot { 'after_run':
|
|
apply => finished,
|
|
}
|
|
}
|