60 security controls evaluated in 6.3 seconds — automated, read-only, risk-prioritized.
Manual CIS Benchmark compliance audits are slow, repetitive, and easy to deprioritize — leading to security gaps going undetected. Audit policies sit at "None" for months. Password policies drift from baseline. Without regular automated checks, the gap between what the benchmark requires and what the environment actually enforces grows quietly.
This is especially critical for Domain Controllers, where a single misconfiguration can expose the entire directory to credential theft, relay attacks, or unauthorized access.
Built an automated, read-only compliance auditing tool:
PowerShell collector pulls live DC configuration across 9 data categories: password policy, audit policy, user rights, registry values, services, firewall, time sync, LSA settings, and security options.
Python comparison engine evaluates collected state against 60 CIS Level 1 controls defined in a JSON ruleset — no code changes needed to add or modify controls. The engine runs entirely on deterministic rule matching; no AI model is called during scan execution, which is why results are fast, consistent, and fully reproducible.
Report generator outputs a risk-prioritized remediation report (Critical → High → Medium → Low) with plain-language explanations and specific GPO paths for each finding.
The tool is read-only — it does not make configuration changes. Remediation remains a reviewed, manual step.
Scan of a Windows Server 2019 Domain Controller:
Key findings: 6 Critical failures (password complexity, LM auth level, firewall, LSA settings). Audit Policy at 0% pass rate (9/9 failed) — no logging coverage for credential validation, Kerberos auth, directory service access, or account management.
System hardening without audit logging is blind — you can't detect what you don't log.
| Category | Total | Pass | Fail | Rate |
|---|---|---|---|---|
| Registry | 13 | 9 | 3 | 69% |
| System Services | 7 | 5 | 2 | 71% |
| UAC | 2 | 1 | 1 | 50% |
| Security Options | 12 | 3 | 7 | 25% |
| User Rights | 5 | 1 | 4 | 20% |
| Password Policy | 6 | 1 | 5 | 17% |
| Audit Policy | 9 | 0 | 9 | 0% |
| Firewall | 2 | 0 | 2 | 0% |
| Account Lockout | 2 | 0 | 2 | 0% |
To verify the automation's time-saving claim, a representative sample was manually audited: all 9 Audit Policy controls plus all 6 Password Policy controls (15 of 60 total), using standard tools (secpol.msc, Group Policy Management Console) cross-referenced against CIS Benchmark documentation.
Manual verification took 22 minutes — a best-case baseline measured with an experienced operator and a pre-prepared checklist. A first-time audit without prior familiarity would take meaningfully longer.
Automated scan: 6.3 seconds for all 60 controls.
v2 will extend the JSON-driven ruleset to cover Azure AD / Entra ID CIS controls, requiring no code changes to the core engine. The same architecture applies: collector pulls cloud tenant state via Graph API, comparison engine evaluates against Entra ID-specific benchmarks, report generator outputs the same risk-prioritized format.