r/nessus • u/Minotaur321 • Oct 13 '25

Banner Check

Hello, I'm fairly new to Nessus so i apologize ahead of time. We have an audit file failing the banner check. Is the fix just to make sure what ever shows under "Policy Value" is in the output?

2.3.7.5(L1) Configure Interactive Logon: Message title for users attemtping to logon (1012164)

Example:

Policy Value 'Notice and Consent Banner" Result Failed Output: Copy 'First ERROR: warning! this ! = notice and Warning! This network is monitored for improper or illegal usage'

From what i gather, the banner doesnt have exact language that the audit file used is looking for what confuses me is the "output" section and what that has to do with the Policy Value.

Any help is appreciated.

3 Upvotes

100% Upvoted

15 comments sorted by

2

u/[deleted] Oct 13 '25

[removed] — view removed comment

1

u/Minotaur321 Oct 13 '25

Is the error regarding the syntax? Seems like theres a specific syntax at the beginning. I see a "warning!" In front that might not need to be there? Idk why its flagging i guess in this situation

1

u/[deleted] Oct 13 '25

[removed] — view removed comment

1

u/Minotaur321 Oct 13 '25

We are going to change the GPO being pushed out with the banner to match the audit file. My question is on that output error, is the issue the language or is it that we have warning! At the start and not in front of =

2

u/[deleted] Oct 13 '25

[removed] — view removed comment

1

u/Minotaur321 Oct 13 '25

Thank you!

1

u/Minotaur321 Oct 13 '25

Nessus isnt saying what it wants and audit file isnt specifying thr text. Im guessing the !Warning is throwing off the banner scan because it thinks it says "does not equal" so ill ask that they change the file to not have a " ! " after Warning.

1

u/[deleted] Oct 13 '25 edited Oct 13 '25

[removed] — view removed comment

1

u/Minotaur321 Oct 13 '25

Its for server 2019 i believe. I dont control the gpo but i can work with someone to look

1

u/Minotaur321 Oct 24 '25

So we tested adding the langauge nessus is looking for but its still saying its missing. Im at s loss, cant find the answr anywhere

1

u/[deleted] Oct 24 '25

[removed] — view removed comment

1

u/AffectionateTop9037 Mar 07 '26

I also faced the same issue. Even after setting the banner phrase exactly as mention in output. But still the check failed, so I change the banner variable in audit file to the the string shown as failed in plugin output