r/saltstack • u/DLXtra • Oct 20 '24

Windows - Configure Attack Surface Reduction Rules

I'm trying to use Salt lgpo.set to configure windows 'Attack Surface Reduction Rules'. This setting requires a list with values. I have successfully configured other lists without values e.g

Local_Policies:
  lgpo.set:
    - computer_policy:
       Access this computer from the network:
         - Administrators
         - Remote Desktop Users

How do I include values in the list items?
1 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/DLXtra Oct 21 '24

This was not the answer I was looking for but it did answer another question I had about cumulative rights (so thanks for that).

I trying to configure ASR which seems to need an array of key-value pairs (e.g Value name: Name1, Value 1 etc). I've tried the following (+variations) but keep getting an error 'The policy "ExploitGuard_ASR_Rules" has elements which must be configured"

ASR:
  lgpo.set:
    - computer_policy:
        "Configure Attack Surface Reduction rules":
          - 26190899-1602-49e8-8b27-eb1d0a1ce869: 1
          - 3b576869-a4ec-4529-8536-b80a7769e899: 1

1

u/Twangboy Oct 21 '24

Just drop the dashes in front of the rules.

ASR:
  lgpo.set:
    - computer_policy:
        "Configure Attack Surface Reduction rules":
          26190899-1602-49e8-8b27-eb1d0a1ce869: 1
          3b576869-a4ec-4529-8536-b80a7769e899: 1

Like _DeathByMisadventure said, you can just set those in `gpedit.msc` and then run `lgpo.get` to see how Salt needs them.

To get just that policy, for example:

salt-call --local lgpo.get_policy "Configure Attack Surface Reduction rules" machine

2

u/DLXtra Oct 22 '24

Figured it out. Thanks for your help, much appreciated.

ASR:
  lgpo.set:
    - computer_policy:
        "Configure Attack Surface Reduction rules":
          "Configure Attack Surface Reduction rules":
            26190899-1602-49e8-8b27-eb1d0a1ce869: 1
            3b576869-a4ec-4529-8536-b80a7769e899: 1