Vault enhancements

[AssafMiron]

Desired Outcome

• Fixing issues is Firewall checks
• Fixing issues in NIC testing
• Fixing miscellaneous issues

Connected Issue/Story

Resolves #[relevant GitHub issue(s), e.g. 76]

Changelog

• This PR does not include user-facing changes and doesn't require a
  CHANGELOG update

Documentation

• This PR does not require updating any documentation

Behavior

• This PR changes product behavior and has been reviewed by a PO - Windows 2019 NIC hardening is different than other OS

[AssafMiron]

@ediulia I have added more fixes based on your testing - would be great if you can verify them
Thanks!

[ediulia]

Hey @AssafMiron

VaultHardeningSteps.psm1
I would recommend replacing the:
ForEach ($rule in $($FWRules | Where-Object { $.DisplayGroup -match "NON_STD" }))
with:
ForEach ($rule in $($FWRules | Where-Object { ($.DisplayGroup -match "NON_STD") -or ($.DisplayGroup -NotMatch "CYBERARK") }))

We need to review the Call for Compare-AmountOfUserPermissions function in line 726 , looks like it copied from CPM hardening. And maybe to add some recommendation reference for keys NTFS recommended permissions

CommonUtil.psm1
Looks like you merged back the Write-LogMessage typos of "Advance Audit" , I fixed all the typos to "Advanced Audit" in previous PRs

Workaround for Error 0x00000057 is not working. now all the checks are failing with the error:
[2021-11-12 09:41:18] [INFO] Checking Advance Audit Policy Sub Category for '{0CCE9235-69AE-11D9-BED3-505054503030}'
[2021-11-12 09:41:18] [ERROR] There was a problem verifying Advance Audit Policy Sub Category for '{0CCE9235-69AE-11D9-BED3-505054503030}'
While the original module function is failing on specific policy check:
here is a part of the script output:
Checking Advanced Audit Policy Sub Category for 'Directory Service Access'
Checking Advanced Audit Policy Sub Category for 'Directory Service Changes'
Checking Advanced Audit Policy Sub Category for 'Directory Service Replication'
Checking Advanced Audit Policy Sub Category for 'Central Access Policy Staging'
Error 0x00000057 occurred:

Firewall check Still returns wrong output
Usecase:
DBParm.ini has one FW rule configured:
AllowNonStandardFWAddresses=[192.168.10.5,192.168.10.7],Yes,3389:outbound/tcp,3389:inbound/tcp

Windows Firewall has 4 manually created inbound rules for RDP TCP/UDP 3389 and WINRM TCP 5985 and 5986

Report shows the next output:
There are 4 Firewall rules that were not created by CyberArk Vault currently configured
Non-Standard Firewall rule ([Any],True,3389:Inbound/TCP) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([Any],True,3389:Inbound/UDP) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([Any],True,5985:Inbound/TCP) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([Any],True,5986:Inbound/TCP) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([192.168.10.5 192.168.10.7],True,Any:Outbound/ICMPv4) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([192.168.10.5 192.168.10.7],True,Any:Inbound/ICMPv4) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([192.168.10.5 192.168.10.7],True,3389:Outbound/TCP) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([192.168.10.5 192.168.10.7],True,3389:Inbound/TCP) is applied but not configured in DBParm.ini
Non-Standard Firewall rule ([192.168.10.5],,3389:outbound/tcp) is configured in DBParm.ini but does not exist in the Vault Firewall policy
Non-Standard Firewall rule ([192.168.10.5],,3389:inbound/tcp) is configured in DBParm.ini but does not exist in the Vault Firewall policy
Non-Standard Firewall rule ([192.168.10.5],True,Any:inbound/ICMPv4) is configured in DBParm.ini but does not exist in the Vault Firewall policy
Non-Standard Firewall rule ([192.168.10.5],True,Any:outbound/ICMPv4) is configured in DBParm.ini but does not exist in the Vault Firewall policy

Vault Keys permissions now returns
The path '"D:\SERVERAPPS\PrivateArk\Keys\PAKeys\operator"' does not exist

One more thing to check:
I have the next exceptions applied on the Vault hardening

First in Windows2019Security.inf file:
"WinRM",2,""
SeRemoteInteractiveLogonRight = *S-1-5-32-544

Second:
I have 2 local Users created and added to the administrators group

Looks like the Script doesn't catch those exceptions on the Vault

[AssafMiron]

@ediulia merged back all fixes, including the one you solved about Error 57
Please take the changes from this branch and test if you can - Thanks!