(#137) Added additional policy mappings

CHANGELOG.md

@@ -1,3 +1,7 @@
+## [2.1.0] - 2026-07-22
+### Added
+- Add support for 'Domain controller: LDAP server signing requirements enforcement' and 'Network security: LDAP client encryption requirements'
+
 ## [2.0.0] - 2026-07-21
 ### Changed
 - **BREAKING**: Replace Puppet 6/7 support with OpenVox 8; CI now runs on Ruby 3.2 and Ruby 4.0. The Gemfile now depends on the `openvox` gem (via `voxpupuli-test`) instead of `puppet`, and `PUPPET_VERSION` replaces `PUPPET_GEM_VERSION`

README.md

@@ -124,13 +124,20 @@ local_security_policy { 'System cryptography: Use FIPS compiant algorithms for e
       Devices: Prevent users from installing printer drivers
       Devices: Restrict CD-ROM access to locally logged-on user only
       Devices: Restrict floppy access to locally logged-on user only
+      Domain controller: Allow server operators to schedule tasks
+      Domain controller: Allow vulnerable Netlogon secure channel connections
+      Domain controller: LDAP server channel binding token requirements
+      Domain controller: LDAP server signing requirements
+      Domain controller: LDAP server signing requirements enforcement
+      Domain controller: Refuse machine account password changes
       Domain member: Digitally encrypt or sign secure channel data (always)
       Domain member: Digitally encrypt secure channel data (when possible)
       Domain member: Digitally sign secure channel data (when possible)
       Domain member: Disable machine account password changes
       Domain member: Maximum machine account password age
       Domain member: Require strong (Windows 2000 or later) session key
       EnableAdminAccount
+      EnableGuestAccount
       Enable computer and user accounts to be trusted for delegation
       Enforce password history
       Force shutdown from a remote system
@@ -185,13 +192,14 @@ local_security_policy { 'System cryptography: Use FIPS compiant algorithms for e
       Network access: Restrict clients allowed to make remote calls to SAM
       Network access: Shares that can be accessed anonymously
       Network access: Sharing and security model for local accounts
-      Network security: All Local System to use computer identity for NTLM
+      Network security: Allow Local System to use computer identity for NTLM
       Network security: Allow LocalSystem NULL session fallback
       Network security: Allow PKU2U authentication requests to this computer to use online identities
       Network security: Configure encryption types allowed for Kerberos
       Network security: Do not store LAN Manager hash value on next password change
       Network security: Force logoff when logon hours expire
       Network security: LAN Manager authentication level
+      Network security: LDAP client encryption requirements
       Network security: LDAP client signing requirements
       Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
       Network security: Minimum session security for NTLM SSP based (including secure RPC) servers

lib/puppet_x/lsp/security_policy.rb

@@ -578,6 +578,11 @@ def self.lsp_mapping
         reg_type: '4',
         policy_type: 'Registry Values',
       },
+      'Domain controller: LDAP server signing requirements enforcement' => {
+        name: 'MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity',
+        reg_type: '4',
+        policy_type: 'Registry Values',
+      },
       'Domain controller: Refuse machine account password changes' => {
         name: 'MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange',
         reg_type: '4',
@@ -826,6 +831,11 @@ def self.lsp_mapping
         reg_type: '4',
         policy_type: 'Registry Values',
       },
+      'Network security: LDAP client encryption requirements' => {
+        name: 'MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientConfidentiality',
+        reg_type: '4',
+        policy_type: 'Registry Values',
+      },
       'Network security: LDAP client signing requirements' => {
         name: 'MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity',
         reg_type: '4',

metadata.json

@@ -1,6 +1,6 @@
 {
   "name": "ayohrling-local_security_policy",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "author": "Paul S. Cannon, Adam Yohrling, Corey Osman, Ryan Russell-Yates, Jordan Wesolowski, Gerben Welter, Thomas Linkin, Andy Adrian, Steven Pritchard",
   "summary": "Windows Local Security Policy management. Forked from cannonps/local_security_policy",
   "license": "Apache-2.0",

spec/unit/puppet/provider/local_security_policy/security_policy_spec.rb

@@ -48,7 +48,7 @@
     SecurityPolicy.new
   end
 
   it 'returns user', skip: 'sid_to_user function is not used anywhere, no need to test' do
     expect(security_policy.sid_to_user('S-1-5-32-556')).to eq('Network Configuration Operators')
     expect(security_policy.sid_to_user('*S-1-5-80-0')).to eq('NT_SERVICE\\ALL_SERVICES')
   end
@@ -105,6 +105,8 @@
         ['MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LdapEnforceChannelBinding', '4'],
       'Domain controller: LDAP server signing requirements' =>
         ['MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerIntegrity', '4'],
+      'Domain controller: LDAP server signing requirements enforcement' =>
+        ['MACHINE\System\CurrentControlSet\Services\NTDS\Parameters\LDAPServerEnforceIntegrity', '4'],
       'Domain controller: Refuse machine account password changes' =>
         ['MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RefusePasswordChange', '4'],
     }.each do |policy_desc, (reg_key, reg_type)|
@@ -131,6 +133,25 @@
     end
   end
 
+  describe 'additional policy mappings' do
+    {
+      'Network security: LDAP client encryption requirements' =>
+        ['MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientConfidentiality', '4'],
+    }.each do |policy_desc, (reg_key, reg_type)|
+      it "maps #{policy_desc}" do
+        mapping = SecurityPolicy.find_mapping_from_policy_desc(policy_desc)
+        expect(mapping[:name]).to eq(reg_key)
+        expect(mapping[:reg_type]).to eq(reg_type)
+        expect(mapping[:policy_type]).to eq('Registry Values')
+      end
+
+      it "reverse maps #{reg_key}" do
+        name, = SecurityPolicy.find_mapping_from_policy_name(reg_key)
+        expect(name).to eq(policy_desc)
+      end
+    end
+  end
+
   describe 'privilege right' do
     let(:resource) do
       Puppet::Type.type(:local_security_policy).new(