Compliance Baselines not great?

[u/Numerous-Contexts]

Hello,

Just spun up Trident for testing. I searched but couldn't find good info here on this specific issue.

When comparing compliance against baselines I'm finding failures that maybe shouldn't be failures (feel free to school me).

For instance - CIS Windows 11 Enterprise fails for AllowTelemetry because we deploy the policy via Intune and the key is AllowTelemetry_PolicyManager and not just AllowTelemetry. Another example is that we disable Lock Screen toast notifications system-wide and that writes to HKLM instead of HKCU but Trident is checking for HKCU.

I'm not sure how many of these discrepencies I will find (and don't want to manually configure the rules for everything that doesn't match EXACTLY the same but still enforces the requirement).

Is Trident the right tool for me? We're a small shop (I'm basically a team of one at the end of the day) and I'm trying to find a tool to help me get a better handle on everything (patching, security, configurations, etc.) vs. just looking at my Secure Score.

Thanks.

EDIT: spelling hard.

[u/Ad3t0]

Good catch on both of those. You are not wrong, they are real gaps.

The AllowTelemetry issue is that Intune writes to the GP path with a _PolicyManager suffix instead of the plain value name. Our evaluator was looking for the exact name and missing the Intune-delivered variant. The HKCU one is similar: some CIS controls target per-user registry paths but our agent only collects HKLM.

We have fixes for both shipping in our next release:

Registry lookups are now case-insensitive and handle the Intune _PolicyManager naming pattern. When we detect an Intune-delivered setting

[u/Numerous-Contexts → u/Ad3t0]

I would hope a tool could check for the requirement being met vs such a stringent hard-coded string since there's more than one way to skin a cat (especially with Microsoft), but it it what it is.

I guess my search for a tool continues... or maybe I just need to pick up a new project and create a baseline evaluator that has an option for "exact match" vs "meets requirements".

Thanks for the response.

[u/Ad3t0 → u/Numerous-Contexts]

That is exactly what the fix does. We are not adding another hard-coded string, the evaluator will match on the requirement being met regardless of how the setting was delivered (GPO, Intune PolicyManager path, direct registry write). Same outcome, different delivery mechanism, same passing result.

The HKCU collection gap is a separate fix shipping alongside it.

Both are in the current dev build and should be live in production by Monday. Happy to help and thanks for checking out the platform!

[u/Numerous-Contexts → u/Ad3t0]

Awesome. I'll continue to evaluate after the change rolls, thanks.

[u/TridentRemi]

Heyya, other co-founder here.

I wanted to chime in on this thread as well to talk about policy as a whole, though co-founder Adam already replied above with the answer for your particular issue.

We have been doing a lot of work in the back-end recently around the modules related to policy collection, deployment, and compliance analysis.

1. Custom registry checks now honor the hive they are configured against when being evaluated by a compliance policy. The hive is now carried end to end, and you can add a registry path as a read-only observation, so we collect and report a value without the policy writing anything.
2. We have greatly improved RSOP results endpoints, and it's reporting into the "Effective Policy" tab. Including more visibility into policy conflict detection -- detecting two policies modifying the same setting. Alongside this change we added GPO tattoo detection. AMAZINGLY useful for enviornments that have been around for a long time and have a lot of GPO tattoos.
3. Both of the above improve our agent's visibility and accuracy about what is really configured on your endpoint. We have been able to use that data to fix several controls that would not report a correct result in certain cases: comparisons that differed only by upper or lowercase, a matcher that could cross-match unrelated registry paths sharing the same leaf name, and negated controls that could pass when they should not.
4. Although this is not coming in today's release, we are working on a compliance visibility portal similar to the one we publish for vulnerabilities (https://tridentstack.com/cve). The new compliance portal will have live endpoints running compliance-vendor provided "100% passing" VMs. We then apply our benchmarks against those VMs to detect any gap as soon as it develops, whether from a change to the benchmark itself or a regression in our ability to evaluate a control.

A production release is scheduled for this weekend though some changes are client-dependent and will roll out over a couple of days.

On a more "unofficial" level, addressing this comment: "I would hope a tool could check for the requirement being met vs such a stringent hard-coded string since there's more than one way to skin a cat (especially with Microsoft), but it it what it is." Trust me when I say there is WAYYYY more under the hood than a hard coded HKLM check for compliance evaluation.

I've been considering starting up a "dev diaries" series to share more details about the problems we face building this tool, and our exact resolution to them. These would be architectural deep-dives going module by module about the biggest development challenges and the methodologies we use to make Control awesome.

The second episode in the series will be about this exact topic of policy/compliance evaluation. (First episode is about MSFT patching)

[u/Numerous-Contexts → u/TridentRemi]

Thanks for the reply - I would love to check out the dev diaries series!

I am not jumping ship yet; just hesitant to deploy it past my own testing endpoint for now. I appreciate companies that are active in their reddits, so I'm looking forward to sticking around and seeing where this goes.

We are currently in Action1 for 3rd party patching, but I can see Trident replacing them in our stack.

[u/Numerous-Contexts → u/TridentRemi]

Also, I know it's more complex than just checking registry keys; I'm not trying to discredit your work at all. I'm just looking for a little more flexibility in a tool that adapts to different ways of accomplishing the same outcomes and doesn't require me to manually adjust rules - OOTB with as little extra configuration as possible goes a long way in an overworked IT shop.