functions/Set-DbcCisConfig.ps1

<#
.SYNOPSIS
Sets values for CIS checks.
.DESCRIPTION
Sets CIS checks to defaults values that were different than normals values. Then sets CIS
test that are set to skip by default to run.

.EXAMPLE
Set-DbcCisConfig

sets the configuration for CIS checks

.EXAMPLE
Set-DbcCisConfig -Verbose

sets the configuration for CIS checks with verbose output

.LINK
https://dbachecks.readthedocs.io/en/latest/functions/Set-DbcCisConfig/
#>


function Set-DbcCisConfig {
    [CmdletBinding(DefaultParameterSetName = 'Name', SupportsShouldProcess)]
    Param (
    )

    Reset-DbcConfig

    #set CIS to what they need to be
    if ($PSCmdlet.ShouldProcess('Configuration' , 'Setting the values for CIS configuration ')) {
        Set-DbcConfig -Name skip.security.nonstandardport -Value $false
        Set-DbcConfig -Name policy.dacallowed -Value $false
        Set-DbcConfig -Name policy.errorlog.logcount -Value 12
        Set-DbcConfig -Name policy.security.oleautomationproceduresdisabled -Value $false
        Set-DbcConfig -Name policy.oleautomation -Value 0
        Set-DbcConfig -Name policy.security.adhocdistributedqueriesenabled -Value $false
        Set-DbcConfig -Name policy.security.clrenabled -Value $false
        Set-DbcConfig -Name policy.security.databasemailenabled -Value $false
        Set-DbcConfig -Name policy.security.xpcmdshelldisabled -Value $false
        Set-DbcConfig -Name skip.instance.defaulttrace -Value $false
        Set-DbcConfig -Name policy.security.latestbuild -Value $true
        Set-DbcConfig -Name skip.instance.oleautomationproceduresdisabled -Value $false
        Set-DbcConfig -Name policy.security.remoteaccessdisabled -Value $false
        Set-DbcConfig -Name policy.security.scanforstartupproceduresdisabled -Value $false
        Set-DbcConfig -Name skip.security.agentserviceadmin -Value $false
        Set-DbcConfig -Name skip.security.asymmetrickeysize -Value $false
        Set-DbcConfig -Name skip.security.builtinadmin -Value $false
        Set-DbcConfig -Name skip.security.clrassembliessafe -Value $false
        Set-DbcConfig -Name policy.security.containedbautoclose -Value $false
        Set-DbcConfig -Name skip.security.containedbautoclose -Value $false
        Set-DbcConfig -Name policy.security.databasemailenabled -Value $false
        Set-DbcConfig -Name policy.security.clrenabled -Value $false
        Set-DbcConfig -Name policy.security.crossdbownershipchaining -Value $false
        Set-DbcConfig -Name policy.security.databasemailenabled -Value $false
        Set-DbcConfig -Name policy.security.adhocdistributedqueriesenabled -Value $false
        Set-DbcConfig -Name policy.security.xpcmdshelldisabled -Value $false
        Set-DbcConfig -Name skip.security.ContainedDBSQLAuth -Value $false
        Set-DbcConfig -Name skip.security.engineserviceadmin -Value $false
        Set-DbcConfig -Name skip.security.fulltextserviceadmin -Value $false
        Set-DbcConfig -Name skip.security.guestuserconnect -Value $false
        Set-DbcConfig -Name skip.security.hideinstance -Value $false
        Set-DbcConfig -Name skip.security.localwindowsgroup -Value $false
        Set-DbcConfig -Name skip.security.loginauditlevelfailed -Value $false
        Set-DbcConfig -Name skip.security.loginauditlevelsuccessful -Value $false
        Set-DbcConfig -Name skip.security.LoginCheckPolicy -Value $false
        Set-DbcConfig -Name skip.security.LoginPasswordExpiration -Value $false
        Set-DbcConfig -Name skip.security.LoginMustChange -Value $false
        Set-DbcConfig -Name skip.security.sadisabled -Value $false
        Set-DbcConfig -Name skip.security.saexist -Value $false
        Set-DbcConfig -Name skip.security.sqlagentproxiesnopublicrole -Value $false
        Set-DbcConfig -Name skip.security.symmetrickeyencryptionlevel -Value $false
        Set-DbcConfig -Name skip.security.publicrolepermission -Value $false
        Set-DbcConfig -Name skip.security.serverprotocol -Value $false
        Set-DbcConfig -Name skip.security.SQLMailXPsDisabled -Value $false
    }
}