diff --git a/psmodules/Check-OnlineAttackCountermeasures.zip b/psmodules/Check-OnlineAttackCountermeasures.zip index d7f91b4b..ac117e73 100644 Binary files a/psmodules/Check-OnlineAttackCountermeasures.zip and b/psmodules/Check-OnlineAttackCountermeasures.zip differ diff --git a/setup/IaC/modules/automationaccount.bicep b/setup/IaC/modules/automationaccount.bicep index 4975e60c..87b469a9 100644 --- a/setup/IaC/modules/automationaccount.bicep +++ b/setup/IaC/modules/automationaccount.bicep @@ -312,7 +312,7 @@ resource guardrailsAC 'Microsoft.Automation/automationAccounts@2021-06-22' = if properties: { contentLink: { uri: '${ModuleBaseURL}/Check-OnlineAttackCountermeasures.zip' - version: '1.0.2' + version: '1.0.3' } } } diff --git a/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psd1 b/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psd1 index 5b9e4c40..dbfa0998 100644 --- a/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psd1 +++ b/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psd1 @@ -13,7 +13,7 @@ RootModule = 'Check-OnlineAttackCountermeasures' # Version number of this module. - ModuleVersion = '1.0.2' + ModuleVersion = '1.0.3' # Supported PSEditions # CompatiblePSEditions = @() diff --git a/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psm1 b/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psm1 index aba18f99..ab4c8f69 100644 --- a/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psm1 +++ b/src/GUARDRAIL 2 MANAGE ACCESS/Audit/Check-OnlineAttackCountermeasures.psm1 @@ -46,10 +46,16 @@ function Check-OnlineAttackCountermeasures { $requiredBannedPasswords = @("password", "Password!", "Summer2018") $missingPasswords = $requiredBannedPasswords | Where-Object { $_ -notin $bannedPasswords } + # Condition: Any of the 3 banned passwords are missing if ($missingPasswords.Count -gt 0) { $IsCompliant = $false $BannedPasswordListNonCompliant = $true } + # Condition:There should be other restricted password components expect only these three + if ($missingPasswords.Count -eq 0 -and $bannedPasswords.Count -eq 3){ + $IsCompliant = $false + $BannedPasswordListNonCompliant = $true + } } } catch {