Problem: I wish to build a VM that I can take onsite to clients to perform "SCAP" like scanning of their domain controllers. I don't need vulnerability scans in terms of like missing patches or exploits. I am more interested in things like Group Policy Settings and what the DoD (or other big named standards entity) says is "best practices". I don't think STIGS are the end all, be all of compliance or security but just one more like thing I can provide my clients while I am onsite. I'm always looking at what more I can provide them and this is one thing I really wish I can could.
Background: I am former Active Duty Air Force and now a Reservist. My civilian job is performing identity risk analysis for our clients. I technically have access to the DoD SCAP scanner and my company's Nessus license. However, the Nessus platform is used by our PenTest team and they have a bigger need for it than I do. My job doesn't require a VulScanner so I can justify purchasing another liscense. However, also don't want to have to wait on another office is they are utilizing the platform or if the client doesn't allow remote scans from the internet to the internal network. I don't feel right using the SCAP scanner as it is a DoD product and they have made sure the commercial market doesn't have access to it. Circumventing their process just because I still have a military CAC seems wrong when I am performing consulting for clients.
What I have researched: I have looked it using OpenSCAP and OpenVAS. OpenSCAP is a no go as they told me directly they do not have Windows scanning capabilities. Yes they can import the SCAP data, but in they can not perform scans against Windows machines. Still researching OpenVAS to see if I can tweak the scans to only do STIG/SCAP content instead of looking at full blown vulnerability scans. Finally, also looking into Microsoft Best Practice Analyzer as maybe a compromise if nothing else exists (which means I'm pigeon holed into what MS thinks is best).