Dit regelen configureert activex regelen initialization via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.
Vereisten
office
Implementatie
Gebruik PowerShell-script activex-control-initialization.ps1 (functie Invoke-Monitoring) β Monitoren.
monitoring
Gebruik PowerShell-script activex-control-initialization.ps1 (functie Invoke-Monitoring) β Controleren.
Remediatie
Gebruik PowerShell-script activex-control-initialization.ps1 (functie Invoke-Remediation) β Herstellen.
Compliance en Auditing
Beleid documentatie
Compliance & Frameworks
CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
# Control: O365-CO-000005 - ActiveX Controls must be initialized in Safe Mode#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Green
try {
$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initialization# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: ActiveXControlInitialization = $expectedValue (Safe Mode)" -ForegroundColor Green
return$true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: ActiveXControlInitialization = $actualValue (Expected: $expectedValue - Safe Mode)" -ForegroundColor Red
return$false
}
}
catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to Safe Mode initialization$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initializationSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (Safe Mode)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
}
catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionfunction Invoke-Revert {
Write-Host "Reverting O365-CO-000005: ActiveX Controls must be initialized in Safe Mode
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return$true
}
$valueName = "ActiveXControlInitialization"
if (Test-Path$RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return$true
}
catch {
Write-Host " Error during revert: # Control: O365-CO-000005 - ActiveX Controls must be initialized in Safe Mode#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Green
try {
$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initialization# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: ActiveXControlInitialization = $expectedValue (Safe Mode)" -ForegroundColor Green
return$true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: ActiveXControlInitialization = $actualValue (Expected: $expectedValue - Safe Mode)" -ForegroundColor Red
return$false
}
} catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to Safe Mode initialization$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initializationSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (Safe Mode)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
} catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionif ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: # Control: O365-CO-000005 - ActiveX Controls must be initialized in Safe Mode#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Green
try {
$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initialization# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: ActiveXControlInitialization = $expectedValue (Safe Mode)" -ForegroundColor Green
return$true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: ActiveXControlInitialization = $actualValue (Expected: $expectedValue - Safe Mode)" -ForegroundColor Red
return$false
}
}
catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to Safe Mode initialization$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initializationSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (Safe Mode)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
}
catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionfunction Invoke-Revert {
Write-Host "Reverting O365-CO-000005: ActiveX Controls must be initialized in Safe Mode
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return$true
}
$valueName = "ActiveXControlInitialization"
if (Test-Path$RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return$true
}
catch {
Write-Host " Error during revert: # Control: O365-CO-000005 - ActiveX Controls must be initialized in Safe Mode#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Green
try {
$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initialization# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: ActiveXControlInitialization = $expectedValue (Safe Mode)" -ForegroundColor Green
return$true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: ActiveXControlInitialization = $actualValue (Expected: $expectedValue - Safe Mode)" -ForegroundColor Red
return$false
}
} catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to Safe Mode initialization$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initializationSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (Safe Mode)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
} catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionif ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
} else {
Write-Host "Usage: .\activex-control-initialization.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings > Security Settings" -ForegroundColor White
Write-Host "> ActiveX Control Initialization: Enabled, Value = 6 (Safe Mode)" -ForegroundColor White
}" -ForegroundColor Red
return$false
}
}
# Main executiontry {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: .\activex-control-initialization.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings > Security Settings" -ForegroundColor White
Write-Host "> ActiveX Control Initialization: Enabled, Value = 6 (Safe Mode)" -ForegroundColor White
}" -ForegroundColor Red
exit 1
}" -ForegroundColor Red
return$false
}
}
# Main executiontry {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: # Control: O365-CO-000005 - ActiveX Controls must be initialized in Safe Mode#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Green
try {
$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initialization# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: ActiveXControlInitialization = $expectedValue (Safe Mode)" -ForegroundColor Green
return$true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: ActiveXControlInitialization = $actualValue (Expected: $expectedValue - Safe Mode)" -ForegroundColor Red
return$false
}
} catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to Safe Mode initialization$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initializationSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (Safe Mode)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
} catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionfunction Invoke-Revert {
Write-Host "Reverting O365-CO-000005: ActiveX Controls must be initialized in Safe Mode
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return$true
}
$valueName = "ActiveXControlInitialization"
if (Test-Path$RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return$true
} catch {
Write-Host " Error during revert: # Control: O365-CO-000005 - ActiveX Controls must be initialized in Safe Mode#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Green
try {
$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initialization# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: ActiveXControlInitialization = $expectedValue (Safe Mode)" -ForegroundColor Green
return$true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: ActiveXControlInitialization = $actualValue (Expected: $expectedValue - Safe Mode)" -ForegroundColor Red
return$false
}
}
catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000005: ActiveX Controls must be initialized in Safe Mode" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to Safe Mode initialization$valueName = "ActiveXControlInitialization"
$expectedValue = 6# 6 = Safe Mode initializationSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (Safe Mode)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
}
catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionif ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: .\activex-control-initialization.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings > Security Settings" -ForegroundColor White
Write-Host "> ActiveX Control Initialization: Enabled, Value = 6 (Safe Mode)" -ForegroundColor White
}" -ForegroundColor Red
return$false
}
}
# Main executiontry {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
} else {
Write-Host "Usage: .\activex-control-initialization.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings > Security Settings" -ForegroundColor White
Write-Host "> ActiveX Control Initialization: Enabled, Value = 6 (Safe Mode)" -ForegroundColor White
}" -ForegroundColor Red
exit 1
}