[!] This project is provided as-is, without warranties or guarantees of any kind, and has not been validated in a production environment unless explicitly stated otherwise. You are solely responsible for evaluating, testing, securing, and operating it safely in your environment and for verifying compliance with any legal, regulatory, or contractual requirements. By using this project, you accept all risk, and the authors and contributors assume no liability for any loss, damage, outage, misuse, or other consequences arising from its use. [!]

YMC

YMC is an agentless Windows Server compliance scanner. It connects to remote hosts over WinRM, runs security checks, and generates HTML or JSON reports with the evidence captured for each check.

Overview

• Scan one host, a comma-separated host list, or a CSV file of targets.
• Map checks to multiple frameworks through YAML profiles in profiles/.
• Generate per-host reports and a combined summary report.
• Run without installing an agent on the target Windows host.

Non-Goals

• YMC does not remediate findings.
• YMC does not guarantee framework certification or audit acceptance.
• YMC does not replace host hardening, patching, or manual review.
• YMC does not currently scan Linux, cloud platforms, or network devices.

Requirements

Controller machine:

• Python 3.10+
• Network access to target hosts over WinRM
• Credentials with permission to read security-relevant settings and logs

Target hosts:

• WinRM enabled on TCP 5985 (HTTP) or 5986 (HTTPS)
• PowerShell available

Assumptions

• The operator understands the target environment and has authorization to scan it.
• The framework profile selected for a scan matches the environment being reviewed.
• Output generated by YMC is one input to an audit or review process, not the entire process.

Setup

1. Create and activate a virtual environment.
2. Install dependencies.
3. Optionally configure the tracked pre-commit hook for secret scanning.

python -m venv .venv
source .venv/bin/activate
python -m pip install -r requirements.txt
git config core.hooksPath .githooks

Reference docs:

• docs/environment_variables.md
• docs/settings_reference.md
• docs/hosts_template.csv
• docs/hosts_example.csv

Usage

List compliance profiles:

python main.py --list-profiles

List named config profiles:

python main.py --list-configs

Scan one host:

python main.py --host web01.corp.local --username CORP\\auditor --profile nist_800_53

Scan multiple hosts:

python main.py --host web01,db01,dc01 --domain corp.local --username CORP\\auditor --profile pci_dss_4

Scan from CSV:

python main.py --csv docs/hosts_example.csv --profile iso_27001 --format both

Write reports to a custom directory:

python main.py --host web01 --username CORP\\auditor --output-dir ./reports --format both

Expected Output

Each scan creates a timestamped output directory containing:

• Per-host HTML and/or JSON reports
• A combined summary HTML report when at least one host scan succeeds
• Exit code 0 when the scan completes with no failing findings
• Exit code 1 for configuration, connection, or runtime failure
• Exit code 2 when the scan completes and one or more checks fail

Configuration

Settings are resolved in this order:

1. CLI flags
2. Environment variables (COLLECTOR_*)
3. Named config profile (--config)
4. Personal settings (~/.ymc/settings.yaml)
5. Program defaults (config/settings.yaml)

See docs/environment_variables.md and docs/settings_reference.md for the full option reference.

Testing And Quality Gates

Run the regression tests:

python -m pytest -q

Run the local quality gate:

./check.sh

check.sh enforces:

1. Git hygiene checks for staged diffs, file modes, suspicious paths, staged artifacts, line endings, and optional secret scans
2. ruff format
3. ruff check
4. bandit
5. gitleaks when installed
6. pip-audit
7. Shell syntax checks and optional shellcheck
8. Markdown text and relative-link validation
9. JSON, YAML, and TOML syntax validation
10. Layered pytest execution over the repo's available test scopes

STRICT_MODE=1 ./check.sh enables a stricter variant that also requires a clean unstaged worktree and turns missing optional tools into failures.

Secret Scanning

The tracked pre-commit hook at .githooks/pre-commit runs gitleaks against staged changes when Git is configured to use that hooks path.

Verify local setup:

gitleaks version
git config --get core.hooksPath

Manual scans:

gitleaks detect --source . --config .gitleaks.toml --redact --verbose
gitleaks protect --staged --config .gitleaks.toml --redact --verbose

Troubleshooting

• pip-audit requires outbound network access to vulnerability sources.
• WinRM failures usually indicate disabled WinRM, blocked firewall rules, or incorrect credentials.
• If terminal output looks wrong, run with --no-color and verify the shell is using UTF-8.
• If --list-configs returns no user profiles, confirm ~/.ymc/profiles/ exists and contains .yaml files.

Known Limitations

• Most automated coverage is still focused on CLI, config-resolution, and CSV target-loading behavior rather than live WinRM collection against Windows hosts.
• The tool is Windows-only today and does not provide Linux, macOS, or cloud collection.
• Some checks depend on target-specific Windows features, services, or PowerShell modules and may return warnings or errors when those are absent.

Legal Disclaimer

See DISCLAIMER.md.

License

MIT