New Capabaility: win-ntuser

Currently there exists content with OVAL Registry tests that require checking information located in the HKEY_CURRENT_USER (HKCU) hive. However, unless the tool used to run these tests is written in such a way as to check all of the user accounts on the server or workstation only the user running the scanning program will be tested for compliance. OVAL does not currently include any requirements for determining which users should be evaluated with HKCU checks. This can lead to devices reporting compliance to OVAL tests when in fact they should have failed the tests. This is a well-known limitation in OVAL. To combat this problem, we are proposing a new OVAL NTUser Test that should be used in place of any Registry tests that require checking the HKCU hive. This proposal is consistent with the previous discussion of this issue at security automation developer days . It is a standardization of a proprietary checking process that has been in operational use on a federal government network for several years.