How to configure the module: Examples and guidelines
The following examples demonstrate the use of CEM in a production environment.
-
Basic configuration examples
When you specify a compliance framework, CEM is configured to provide rule enforcement and configuration for that framework. For example, to enforce the Center for Internet Security (CIS) Server Level 1 benchmark for a node, you must classify the node with thecem_windows
class, set thebenchmark
parameter tocis
, and run Puppet. To learn more about CEM configuration, see the following examples. -
Advanced configuration example
Building on the basic configuration examples, thecontrol_configs
section specifies advanced options for controls. -
Run Desired State Configuration resources as a specific user
Desired State Configuration (DSC) requires local administrator privileges to modify Windows resources. Typically, the Puppet agent runs under a user account with these permissions. However, if the Puppet agent on a node does not have local administrator permissions, you can use Hiera to configure a user account that does have the required permissions. -
Allow local accounts to access nodes
To allow a local user account to access a node with remote desktop protocol (RDP), set the top-level optionallow_local_account_rdp
totrue
. -
Enforce specific rules
To configure CEM to enforce only specific rules, use theonly
key. -
Ignore specific rules
To configure CEM to ignore specific rules, use theignore
key. -
Customize rules
You can customize most rules by using thecontrol_configs
key and supplying the key with a hash value. -
Rename the Administrator and Guest accounts
To help protect your infrastructure, rename theAdministrator
andGuest
accounts.