Windows Server 2025 `V-278193.c` emits CertificateImport without mandatory Thumbprint

[PleaseStopAsking]

PowerSTIG 4.30.0 generates an invalid CertificateImport DSC resource for V-278193.c in the Windows Server 2025 Member Server STIG 1.1.

The processed rule is stored as a RootCertificateRule, but contains:

<Rule id="V-278193.c" dscresource="none">
    <CertificateName />
    <Thumbprint />
</Rule>

Despite dscresource="none", the rule is selected by windows.RootCertificate.ps1 and emitted as a CertificateImport resource.

DSC then fails while applying the generated MOF:

Could not find mandatory property Thumbprint. Add this property and try again.

CategoryInfo          : ObjectNotFound
FullyQualifiedErrorId : MI RESULT 6

The root cause appears to be in the way that windows.RootCertificate.ps1 selects rules by their PowerShell type such as $rules = Select-Rule -RuleList $stig.RuleList -Type RootCertificateRule.

Select-Rule filters by rule type and DuplicateOf, but does not exclude rules where DscResource is None:

return $RuleList.Where({
    $_.GetType().ToString() -eq $Type -and
    [string]::IsNullOrEmpty($_.DuplicateOf)
})

Therefore, V-278193.c remains a RootCertificateRule and reaches:

CertificateImport (Get-ResourceTitle -Rule $rule) {
    Thumbprint = $rule.Thumbprint
    Location   = 'LocalMachine'
    Store      = $storeLocation
    Path       = $rule.Location
}

Because its thumbprint is empty, DSC receives an invalid resource instance.

Adding V-278193.c to SkipRule does not work because _LoadRules only creates a SkippedRule when:
$rule.dscresource -ne 'None'

Workaround:

Exception = @{
    'V-278193.c' = @{
        DuplicateOf = 'V-278193.a'
    }
}