💼 Management Samenvatting
Deze security regelen waarborgt de correcte configuratie van beveiligingsinstellingen op Windows endpoints.
Aanbeveling
IMPLEMENT
Risico zonder
High
Risk Score
7/10
Implementatie
2u (tech: 1u)
Van toepassing op:
✓ Windows
Deze instelling is onderdeel van de Windows security baseline en beschermt tegen bekende aanvalsvectoren door het afdwingen van veilige configuraties.
PowerShell Modules Vereist
Primary API: Graph
Connection:
Required Modules: Microsoft.Graph.DeviceManagement
Connection:
Connect-MgGraphRequired Modules: Microsoft.Graph.DeviceManagement
Implementatie
Dit regelen configureert ceip disabled via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.
Vereisten
office
Implementatie
Gebruik PowerShell-script ceip-disabled.ps1 (functie Invoke-Monitoring) – Monitoren.
monitoring
Gebruik PowerShell-script ceip-disabled.ps1 (functie Invoke-Monitoring) – Controleren.
Remediatie
Gebruik PowerShell-script ceip-disabled.ps1 (functie Invoke-Remediation) – Herstellen.
Compliance en Auditing
Beleid documentatie
Compliance & Frameworks
- CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
- BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
- ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
# Control: O365-CO-000011 - Customer Experience Improvement Program must be disabled in all Office applications
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKLM:\Software\Policies\Microsoft\Office\16.0\Common\QMEnable",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000011: Customer Experience Improvement Program must be disabled" -ForegroundColor Green
try {
$valueName = "CEIPDisabled"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host " Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host " Compliant: CEIP is disabled" -ForegroundColor Green
return $true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host " Non-Compliant: CEIP not disabled" -ForegroundColor Red
return $false
}
}
catch {
Write-Host " Error during monitoring: $_" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-CO-000011: Customer Experience Improvement Program must be disabled" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would set registry value" -ForegroundColor Cyan
return $true
}
if (-not (Test-Path $RegistryPath)) {
New-Item -Path $RegistryPath -Force | Out-Null
Write-Host " Created registry path: $RegistryPath" -ForegroundColor Green
}
$valueName = "CEIPDisabled"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host " Set $valueName to $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
return Invoke-Monitoring
}
catch {
Write-Host " Error during remediation: $_" -ForegroundColor Red
return $false
}
}
function Invoke-Revert {
Write-Host "Reverting O365-CO-000011: Customer Experience Improvement Program must be disabled" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return $true
}
$valueName = "CEIPDisabled"
if (Test-Path $RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return $true
}
catch {
Write-Host " Error during revert: $_" -ForegroundColor Red
return $false
}
}
# Main execution
try {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: $_" -ForegroundColor Red
exit 1
}
Risico zonder implementatie
Risico zonder implementatie
High: No auth tracking.
Management Samenvatting
Schakel in audit logging.
- Implementatietijd: 2 uur
- FTE required: 0.01 FTE