Version 2.3.0

Released 7 October 2026

This release introduces Puppet native modules to replace the Desired State Configuration (DSC) modules used in previous releases. The new modules provide direct policy enforcement through native Windows APIs and more granular reporting of CIS control changes in Puppet agent reports. This release also resolves an AutoAdminLogon control issue that could cause inaccurate CIS compliance scan results.

Important: Before you upgrade to v2.3.0, remove previous modules from your Puppetfile and download the latest dependencies.

New features and enhancements

Puppet native modules replace PowerShell DSC-based modules. The new modules, puppetlabs-security_policy and puppetlabs-audit_policy, enforce security and audit policies directly through native Windows APIs, eliminating the DSC layer and reducing processing overhead.

This enhancement introduces the following changes:

• Per-setting reporting. Because each CIS control maps to its own resource in the Puppet catalog, Puppet agent reports now show changes to individual settings instead of grouping multiple settings within a DSC resource.
• Puppet-maintained modules. Puppet maintains the new modules, allowing features and fixes to be delivered independently of DSC module releases.

Resolved issue

Issue with the AutoAdminLogon setting causes CIS compliance scans to fail. Although the AutoAdminLogon registry setting was correctly enforced on Windows Server 2019 and Windows Server 2022, compliance scans reported the setting as noncompliant. This issue occurred because the control was defined with an incorrect registry type. The AutoAdminLogon control now uses the registry string type specified by the CIS Benchmark, allowing systems with AutoAdminLogon disabled to pass compliance scans.