# Windows resources

> The seven resource types that inspect Windows subsystems through PowerShell.

Source: https://refpoint.dev/docs/resources/windows

These seven resource types read Windows subsystems, all of them through
PowerShell. Give a control that uses them `platform = ["windows"]`, so it is
omitted on other targets rather than erroring there.

## registry

Key-addressed, for example
`HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion`.

| Attribute | Type | Notes |
|---|---|---|
| `key` | string, address | |
| `exists` | bool | |
| `value_name` | string | Value under the key |
| `value` | string | Expected string form. DWORD and QWORD use the decimal integer as a string |
| `type` | string | `String`, `DWord`, `QWord`, `MultiString`, `ExpandString`, `Binary` |

## windows_feature

Name-addressed, for example `Web-Server` or `Telnet-Client`.

| Attribute | Type |
|---|---|
| `name` | string, address |
| `installed` | bool |

## security_policy

Label-only. Reads the Local Security Policy exported by
`secedit /export /cfg`, an INF file with sections such as `[System Access]`,
`[Privilege Rights]`, and `[Event Audit]`.

| Attribute | Type | Notes |
|---|---|---|
| `section` | string, required | For example `System Access` |
| `key` | string, required | For example `MinimumPasswordLength` |
| `value` | string | Exact match after trimming |
| `min_value` | int | |
| `max_value` | int | |

```hcl
check "password-length" "security_policy" {
  section   = "System Access"
  key       = "MinimumPasswordLength"
  min_value = 14
}
```

## audit_policy

Name-addressed by subcategory, for example `Logon` or `Account Lockout`, read
via `auditpol.exe`.

| Attribute | Type | Notes |
|---|---|---|
| `name` | string, address | Subcategory |
| `setting` | string, required | Case-insensitive: `No Auditing`, `Success`, `Failure`, `Success and Failure` |

It refuses a non-Windows target with an explanatory failing assertion.

## windows_firewall

Name-addressed, with two modes decided by the address.

Profile mode applies when the address is `Domain`, `Private`, or `Public`:

| Attribute | Type | Notes |
|---|---|---|
| `enabled` | bool | |
| `default_inbound_action` | string | `Block` or `Allow` |
| `default_outbound_action` | string | `Block` or `Allow` |

Rule mode applies to any other address, which is read as a rule display name:

| Attribute | Type | Notes |
|---|---|---|
| `rule_exists` | bool | |
| `enabled` | bool | Shared with profile mode |
| `action` | string | `Allow` or `Block` |
| `direction` | string | `Inbound` or `Outbound` |

## windows_hotfix

Name-addressed by KB identifier, for example `KB5005565`, via `Get-HotFix`.

| Attribute | Type |
|---|---|
| `name` | string, address |
| `installed` | bool |

## windows_scheduled_task

Name-addressed by full task path, for example `\Vendor\Updater`. Vendor
updaters and persistence mechanisms both live here.

| Attribute | Type | Notes |
|---|---|---|
| `name` | string, address | |
| `exists` | bool | |
| `enabled` | bool | |
| `run_as` | string | Principal (UserId), case-insensitive, for example `SYSTEM` |