{
    "properties": {
        "displayName": "Deploy prerequisites to audit Windows VMs configurations in 'Security Options - Microsoft Network Client'",
        "policyType": "BuiltIn",
        "mode": "Indexed",
        "description": "This policy creates a Guest Configuration assignment to audit Windows virtual machines with non-compliant settings in Group Policy category: 'Security Options - Microsoft Network Client'. It also creates a system-assigned managed identity and deploys the VM extension for Guest Configuration. This policy should only be used along with its corresponding audit policy in an initiative. For more information on Guest Configuration policies, please visit https://aka.ms/gcpol",
        "metadata": {
            "version": "1.2.0-deprecated",
            "category": "Guest Configuration",
            "requiredProviders": [
                "Microsoft.GuestConfiguration"
            ],
            "deprecated": true
        },
        "parameters": {
            "MicrosoftNetworkClientDigitallySignCommunicationsAlways": {
                "type": "string",
                "metadata": {
                    "displayName": "Microsoft network client: Digitally sign communications (always)",
                    "description": "Specifies whether packet signing is required by the SMB client component."
                },
                "defaultValue": "1"
            },
            "MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers": {
                "type": "string",
                "metadata": {
                    "displayName": "Microsoft network client: Send unencrypted password to third-party SMB servers",
                    "description": "Specifies whether the SMB redirector will send plaintext passwords during authentication to third-party SMB servers that do not support password encryption. It is recommended that you disable this policy setting unless there is a strong business case to enable it."
                },
                "defaultValue": "0"
            },
            "MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession": {
                "type": "string",
                "metadata": {
                    "displayName": "Microsoft network server: Amount of idle time required before suspending session",
                    "description": "Specifies the amount of continuous idle time that must pass in an SMB session before the session is suspended because of inactivity. The format of the value is two integers separated by a comma, denoting an inclusive range."
                },
                "defaultValue": "1,15"
            },
            "MicrosoftNetworkServerDigitallySignCommunicationsAlways": {
                "type": "string",
                "metadata": {
                    "displayName": "Microsoft network server: Digitally sign communications (always)",
                    "description": "Specifies whether packet signing is required by the SMB server component."
                },
                "defaultValue": "1"
            },
            "MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire": {
                "type": "string",
                "metadata": {
                    "displayName": "Microsoft network server: Disconnect clients when logon hours expire",
                    "description": "Specifies whether to disconnect users who are connected to the local computer outside their user account's valid logon hours. This setting affects the Server Message Block (SMB) component. If you enable this policy setting you should also enable 'Network security: Force logoff when logon hours expire'"
                },
                "defaultValue": "1"
            }
        },
        "policyRule": {
            "if": {
                "anyOf": [
                    {
                        "allOf": [
                            {
                                "field": "type",
                                "equals": "Microsoft.Compute/virtualMachines"
                            },
                            {
                                "anyOf": [
                                    {
                                        "field": "Microsoft.Compute/imagePublisher",
                                        "in": [
                                            "esri",
                                            "incredibuild",
                                            "MicrosoftDynamicsAX",
                                            "MicrosoftSharepoint",
                                            "MicrosoftVisualStudio",
                                            "MicrosoftWindowsDesktop",
                                            "MicrosoftWindowsServerHPCPack"
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "MicrosoftWindowsServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageSKU",
                                                "notLike": "2008*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "MicrosoftSQLServer"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "notLike": "SQL2008*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-dsvm"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "dsvm-windows"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "microsoft-ads"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "in": [
                                                    "standard-data-science-vm",
                                                    "windows-data-science-vm"
                                                ]
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "batch"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "equals": "rendering-windows2016"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "center-for-internet-security-inc"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "cis-windows-server-201*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "pivotal"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "bosh-windows-server*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "field": "Microsoft.Compute/imagePublisher",
                                                "equals": "cloud-infrastructure-services"
                                            },
                                            {
                                                "field": "Microsoft.Compute/imageOffer",
                                                "like": "ad*"
                                            }
                                        ]
                                    },
                                    {
                                        "allOf": [
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/osProfile.windowsConfiguration",
                                                        "exists": "true"
                                                    },
                                                    {
                                                        "field": "Microsoft.Compute/virtualMachines/storageProfile.osDisk.osType",
                                                        "like": "Windows*"
                                                    }
                                                ]
                                            },
                                            {
                                                "anyOf": [
                                                    {
                                                        "field": "Microsoft.Compute/imageSKU",
                                                        "exists": "false"
                                                    },
                                                    {
                                                        "allOf": [
                                                            {
                                                                "field": "Microsoft.Compute/imageSKU",
                                                                "notLike": "2008*"
                                                            },
                                                            {
                                                                "field": "Microsoft.Compute/imageOffer",
                                                                "notLike": "SQL2008*"
                                                            }
                                                        ]
                                                    }
                                                ]
                                            }
                                        ]
                                    }
                                ]
                            }
                        ]
                    },
                    {
                        "allOf": [
                            {
                                "field": "type",
                                "equals": "Microsoft.HybridCompute/machines"
                            },
                            {
                                "field": "Microsoft.HybridCompute/imageOffer",
                                "like": "windows*"
                            }
                        ]
                    }
                ]
            },
            "then": {
                "effect": "deployIfNotExists",
                "details": {
                    "roleDefinitionIds": [
                        "/providers/microsoft.authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c"
                    ],
                    "type": "Microsoft.GuestConfiguration/guestConfigurationAssignments",
                    "name": "AzureBaseline_SecurityOptionsMicrosoftNetworkClient",
                    "existenceCondition": {
                        "field": "Microsoft.GuestConfiguration/guestConfigurationAssignments/parameterHash",
                        "equals": "[base64(concat('Microsoft network client: Digitally sign communications (always);ExpectedValue', '=', parameters('MicrosoftNetworkClientDigitallySignCommunicationsAlways'), ',', 'Microsoft network client: Send unencrypted password to third-party SMB servers;ExpectedValue', '=', parameters('MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers'), ',', 'Microsoft network server: Amount of idle time required before suspending session;ExpectedValue', '=', parameters('MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession'), ',', 'Microsoft network server: Digitally sign communications (always);ExpectedValue', '=', parameters('MicrosoftNetworkServerDigitallySignCommunicationsAlways'), ',', 'Microsoft network server: Disconnect clients when logon hours expire;ExpectedValue', '=', parameters('MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire')))]"
                    },
                    "deployment": {
                        "properties": {
                            "mode": "incremental",
                            "parameters": {
                                "vmName": {
                                    "value": "[field('name')]"
                                },
                                "location": {
                                    "value": "[field('location')]"
                                },
                                "type": {
                                    "value": "[field('type')]"
                                },
                                "configurationName": {
                                    "value": "AzureBaseline_SecurityOptionsMicrosoftNetworkClient"
                                },
                                "MicrosoftNetworkClientDigitallySignCommunicationsAlways": {
                                    "value": "[parameters('MicrosoftNetworkClientDigitallySignCommunicationsAlways')]"
                                },
                                "MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers": {
                                    "value": "[parameters('MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers')]"
                                },
                                "MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession": {
                                    "value": "[parameters('MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession')]"
                                },
                                "MicrosoftNetworkServerDigitallySignCommunicationsAlways": {
                                    "value": "[parameters('MicrosoftNetworkServerDigitallySignCommunicationsAlways')]"
                                },
                                "MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire": {
                                    "value": "[parameters('MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire')]"
                                }
                            },
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "parameters": {
                                    "vmName": {
                                        "type": "string"
                                    },
                                    "location": {
                                        "type": "string"
                                    },
                                    "type": {
                                        "type": "string"
                                    },
                                    "configurationName": {
                                        "type": "string"
                                    },
                                    "MicrosoftNetworkClientDigitallySignCommunicationsAlways": {
                                        "type": "string"
                                    },
                                    "MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers": {
                                        "type": "string"
                                    },
                                    "MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession": {
                                        "type": "string"
                                    },
                                    "MicrosoftNetworkServerDigitallySignCommunicationsAlways": {
                                        "type": "string"
                                    },
                                    "MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire": {
                                        "type": "string"
                                    }
                                },
                                "resources": [
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('microsoft.hybridcompute/machines'))]",
                                        "apiVersion": "2018-11-20",
                                        "type": "Microsoft.HybridCompute/machines/providers/guestConfigurationAssignments",
                                        "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName'))]",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "guestConfiguration": {
                                                "name": "[parameters('configurationName')]",
                                                "version": "1.*",
                                                "configurationParameter": [
                                                    {
                                                        "name": "Microsoft network client: Digitally sign communications (always);ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkClientDigitallySignCommunicationsAlways')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network client: Send unencrypted password to third-party SMB servers;ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network server: Amount of idle time required before suspending session;ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network server: Digitally sign communications (always);ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkServerDigitallySignCommunicationsAlways')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network server: Disconnect clients when logon hours expire;ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire')]"
                                                    }
                                                ]
                                            }
                                        }
                                    },
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.Compute/virtualMachines'))]",
                                        "apiVersion": "2018-11-20",
                                        "type": "Microsoft.Compute/virtualMachines/providers/guestConfigurationAssignments",
                                        "name": "[concat(parameters('vmName'), '/Microsoft.GuestConfiguration/', parameters('configurationName'))]",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "guestConfiguration": {
                                                "name": "[parameters('configurationName')]",
                                                "version": "1.*",
                                                "configurationParameter": [
                                                    {
                                                        "name": "Microsoft network client: Digitally sign communications (always);ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkClientDigitallySignCommunicationsAlways')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network client: Send unencrypted password to third-party SMB servers;ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkClientSendUnencryptedPasswordToThirdpartySMBServers')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network server: Amount of idle time required before suspending session;ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkServerAmountOfIdleTimeRequiredBeforeSuspendingSession')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network server: Digitally sign communications (always);ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkServerDigitallySignCommunicationsAlways')]"
                                                    },
                                                    {
                                                        "name": "Microsoft network server: Disconnect clients when logon hours expire;ExpectedValue",
                                                        "value": "[parameters('MicrosoftNetworkServerDisconnectClientsWhenLogonHoursExpire')]"
                                                    }
                                                ]
                                            }
                                        }
                                    },
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.Compute/virtualMachines'))]",
                                        "apiVersion": "2019-07-01",
                                        "type": "Microsoft.Compute/virtualMachines",
                                        "identity": {
                                            "type": "SystemAssigned"
                                        },
                                        "name": "[parameters('vmName')]",
                                        "location": "[parameters('location')]"
                                    },
                                    {
                                        "condition": "[equals(toLower(parameters('type')), toLower('Microsoft.Compute/virtualMachines'))]",
                                        "apiVersion": "2019-07-01",
                                        "name": "[concat(parameters('vmName'), '/AzurePolicyforWindows')]",
                                        "type": "Microsoft.Compute/virtualMachines/extensions",
                                        "location": "[parameters('location')]",
                                        "properties": {
                                            "publisher": "Microsoft.GuestConfiguration",
                                            "type": "ConfigurationforWindows",
                                            "typeHandlerVersion": "1.1",
                                            "autoUpgradeMinorVersion": true,
                                            "settings": {},
                                            "protectedSettings": {}
                                        },
                                        "dependsOn": [
                                            "[concat('Microsoft.Compute/virtualMachines/',parameters('vmName'),'/providers/Microsoft.GuestConfiguration/guestConfigurationAssignments/',parameters('configurationName'))]"
                                        ]
                                    }
                                ]
                            }
                        }
                    }
                }
            }
        }
    },
    "id": "/providers/Microsoft.Authorization/policyDefinitions/bbcdd8fa-b600-4ee3-85b8-d184e3339652",
    "name": "bbcdd8fa-b600-4ee3-85b8-d184e3339652"
}