Audit plist doesn't exist?

[JakeRandall99]

Hi all

I am pretty new to CIS still and trying to work my head around a lot of it

I am noticing a lot of our machines are failing to run the compliance script, we are getting the following error back when looking at the logs:
Executing Policy CIS Level 1 - Sequoia Rev1.1 Remediation Policy Running script Sequoia_carwow_cis_lvl1_sequioarev1.1_compliance.sh... Script exit code: 1 Script result: Audit plist doesn't exist, please run Audit Check First

I don't remember this being an issue when we deployed this CIS version. Recently we updated and re-uploaded a new password policy config profile because of the known lockout bug on the login screen.

Any ideas why this might be happening?

[erefneb]

In a nutshell you must first check the system to generate the list of findings to fix.
Run the script with --help "Sequoia_carwow_cis_lvl1_sequioarev1.1_compliance.sh --help"
I like to use the --reset-all --cfc options.

[JakeRandall99]

Through JAMF we have a policy which runs the compliance script whenever a device checks in, we have the "--check" parameter there which would usually run

[erefneb]

This is what works for me.
Jamf Policy: Audit and Remediate
Trigger: Recurring Check-in
Execution Frequency: Once every day or Once every week (up to you)
Script: Sequoia_carwow_cis_lvl1_sequioarev1.1_compliance.sh
Parameter 4: --reset-all
Parameter 5: --cfc

This will run the compliance script one every day (or week).
The script will zero out the mSCP logs, run a check, fix any command line findings, then run another check to close the loop.
Then run an inventory.

[JakeRandall99]

I will give this a go! Thanks