Windows resources

These seven resource types read Windows subsystems, all of them through PowerShell. Give a control that uses them platform = ["windows"], so it is omitted on other targets rather than erroring there.

registry

Key-addressed, for example HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion.

Attribute	Type	Notes
`key`	string, address
`exists`	bool
`value_name`	string	Value under the key
`value`	string	Expected string form. DWORD and QWORD use the decimal integer as a string
`type`	string	`String`, `DWord`, `QWord`, `MultiString`, `ExpandString`, `Binary`

windows_feature

Name-addressed, for example Web-Server or Telnet-Client.

Attribute	Type
`name`	string, address
`installed`	bool

security_policy

Label-only. Reads the Local Security Policy exported by secedit /export /cfg, an INF file with sections such as [System Access], [Privilege Rights], and [Event Audit].

Attribute	Type	Notes
`section`	string, required	For example `System Access`
`key`	string, required	For example `MinimumPasswordLength`
`value`	string	Exact match after trimming
`min_value`	int
`max_value`	int

check "password-length" "security_policy" {
  section   = "System Access"
  key       = "MinimumPasswordLength"
  min_value = 14
}

audit_policy

Name-addressed by subcategory, for example Logon or Account Lockout, read via auditpol.exe.

Attribute	Type	Notes
`name`	string, address	Subcategory
`setting`	string, required	Case-insensitive: `No Auditing`, `Success`, `Failure`, `Success and Failure`

It refuses a non-Windows target with an explanatory failing assertion.

windows_firewall

Name-addressed, with two modes decided by the address.

Profile mode applies when the address is Domain, Private, or Public:

Attribute	Type	Notes
`enabled`	bool
`default_inbound_action`	string	`Block` or `Allow`
`default_outbound_action`	string	`Block` or `Allow`

Rule mode applies to any other address, which is read as a rule display name:

Attribute	Type	Notes
`rule_exists`	bool
`enabled`	bool	Shared with profile mode
`action`	string	`Allow` or `Block`
`direction`	string	`Inbound` or `Outbound`

windows_hotfix

Name-addressed by KB identifier, for example KB5005565, via Get-HotFix.

Attribute	Type
`name`	string, address
`installed`	bool

windows_scheduled_task

Name-addressed by full task path, for example \Vendor\Updater. Vendor updaters and persistence mechanisms both live here.

Attribute	Type	Notes
`name`	string, address
`exists`	bool
`enabled`	bool
`run_as`	string	Principal (UserId), case-insensitive, for example `SYSTEM`