# Need some help with custom CIS benchmarks for Windows

**URL:** <https://discourse.chef.io/t/need-some-help-with-custom-cis-benchmarks-for-windows/21569>\
**Category:** Chef InSpec\
**Created:** [October 27, 2022, 10:29pm UTC](https://discourse.chef.io/t/need-some-help-with-custom-cis-benchmarks-for-windows/21569 "2022-10-27T22:29:53Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sms552](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@sms552](https://discourse.chef.io/u/sms552)\
**Post date:** [October 27, 2022, 10:29pm UTC](https://discourse.chef.io/t/need-some-help-with-custom-cis-benchmarks-for-windows/21569/1 "2022-10-27T22:29:53Z")

</div>

My company took the CIS benchmarks and used them as a guide but made changes to them. I was tasked with writing the controls to match. I do not have a development background but can usually fumble my way through reverse engineering code when I need to. In this case I am stumped. In security policy we have added "Domain Admins" to several policies. I have updated the code to ensure it checks for the proper SID's but the problem is we have 6 different domains. The code I wrote is below but it doesnt work. Is there any way for the control to check just the name and not the SID? I havent found anything online that points to a solution.

```auto
control "Profile single process" do
    title "1.6.17 Profile single process "
    desc "The recommended state for this setting is: Administrators and Domain Admins"
    impact 1.0
    describe security_policy do
        its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-32-544"] }
    end
    describe.one do
        describe security_policy do
            its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-21-2130074997-81545660-1235820382-512"] }
        end
        describe security_policy do
            its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-21-3053786073-42204541-311281481-512"] }
        end
        describe security_policy do
            its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-21-2966979743-2295456427-714907244-512"] }
        end
        describe security_policy do
            its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-21-91418938-2878961142-3976046778-512"] }
        end
        describe security_policy do
            its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-21-2850343096-11590899-1094912238-512"] }
        end
        describe security_policy do
            its("SeProfileSingleProcessPrivilege") { should include ["S-1-5-21-3511417508-3068775331-305963285-512"] }
        end
    end
end

```

---

<div class="post-metadata">

**Author:** ![Stromweld](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/stromweld/32/3416_2.png) [@Stromweld](https://discourse.chef.io/u/Stromweld)\
**Post date:** [October 27, 2022, 10:51pm UTC](https://discourse.chef.io/t/need-some-help-with-custom-cis-benchmarks-for-windows/21569/2 "2022-10-27T22:51:32Z")

</div>

There is a translate\_sid property. Set it to true like in the example shown here. [security\_policy resource](https://docs.chef.io/inspec/resources/security_policy/#syntax)

---

<div class="post-metadata">

**Author:** ![sms552](https://avatars.discourse-cdn.com/v4/letter/s/0ea827/32.png) [@sms552](https://discourse.chef.io/u/sms552)\
**Post date:** [November 1, 2022, 3:58pm UTC](https://discourse.chef.io/t/need-some-help-with-custom-cis-benchmarks-for-windows/21569/3 "2022-11-01T15:58:38Z")

</div>

Sorry for the delay in responding. I have tried this and was unable to get it working. Is there something I am missing. I get a basic "Input/output error - TerminateProcess (Errno::EIO)" when trying to run code as simple as:

describe security\_policy(translate\_sid: true) do  
its("SeDebugPrivilege") { should include "Administrators" }  
end

---

<div class="post-metadata">

**Author:** ![Stromweld](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/stromweld/32/3416_2.png) [@Stromweld](https://discourse.chef.io/u/Stromweld)\
**Post date:** [November 1, 2022, 4:05pm UTC](https://discourse.chef.io/t/need-some-help-with-custom-cis-benchmarks-for-windows/21569/4 "2022-11-01T16:05:58Z")

</div>

it probably still needs the array ["Administrator"] around the user since it would take in multiple users/groups. What version of inspec are you running?