L1 BIO 16.01 ISO A.12.4.1 CIS 18.9.19.2

Control Blogging Disabled

📅 2025-10-30

•

⏱️ 2 minuten lezen

•

🔴 Must-Have

💼 Management Samenvatting

Deze security regelen waarborgt de correcte configuratie van beveiligingsinstellingen op Windows endpoints.

Aanbeveling

IMPLEMENT

Risico zonder

High

Risk Score

7/10

Implementatie

2u (tech: 1u)

Van toepassing op:

✓ Windows

Deze instelling is onderdeel van de Windows security baseline en beschermt tegen bekende aanvalsvectoren door het afdwingen van veilige configuraties.

PowerShell Modules Vereist

Primary API: Graph
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Dit regelen configureert regelen blogging disabled via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.

Vereisten

office

Implementatie

Gebruik PowerShell-script control-blogging-disabled.ps1 (functie Invoke-Monitoring) – Monitoren.

monitoring

Gebruik PowerShell-script control-blogging-disabled.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script control-blogging-disabled.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance en Auditing

Beleid documentatie

Compliance & Frameworks

CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell

# Control: O365-CO-000025 - Blogging functionality must be disabled in all Office applications
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Green

    try {
        $valueName = "DisableBloggingControl"
        $expectedValue = 1  # 1 = Disabled, 0 = Enabled

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: DisableBloggingControl = $expectedValue (Blogging disabled)" -ForegroundColor Green
            return $true
        }
        else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: DisableBloggingControl = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    }
    catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "DisableBloggingControl" -Value 1 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: DisableBloggingControl = 1 (Blogging disabled)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    }
    catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}


function Invoke-Revert {
    Write-Host "Reverting O365-CO-000025: Blogging functionality must be disabled in all Office applications
" -ForegroundColor Yellow
    
    try {
        if ($WhatIf) {
            Write-Host "  [WhatIf] Would remove registry value" -ForegroundColor Cyan
            return $true
        }
        
        $valueName = "DisableBloggingControl"
        
        if (Test-Path $RegistryPath) {
            Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
            Write-Host "  Removed registry value: $valueName" -ForegroundColor Green
        }
        
        return $true
    }
    catch {
        Write-Host "  Error during revert: # Control: O365-CO-000025 - Blogging functionality must be disabled in all Office applications
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Green

    try {
        $valueName = "DisableBloggingControl"
        $expectedValue = 1  # 1 = Disabled, 0 = Enabled

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: DisableBloggingControl = $expectedValue (Blogging disabled)" -ForegroundColor Green
            return $true
        } else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: DisableBloggingControl = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    } catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "DisableBloggingControl" -Value 1 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: DisableBloggingControl = 1 (Blogging disabled)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    } catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

if ($Monitoring) {
        $result = Invoke-Monitoring
        exit $(if ($result) { 0 } else { 1 })
    }
    elseif ($Remediation) {
        $result = Invoke-Remediation
        exit $(if ($result) { 0 } else { 1 })
    }
    elseif ($Revert) {
        $result = Invoke-Revert
        exit $(if ($result) { 0 } else { 1 })
    }
    else {
        Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
    }
}
catch {
    Write-Host "Script execution error: # Control: O365-CO-000025 - Blogging functionality must be disabled in all Office applications
        #Requires -Version 5.1
        # DISA STIG Microsoft Office 365 ProPlus v3r3

        param(
            [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
            [switch]$Monitoring,
            [switch]$Remediation,
            [switch]$Revert,
            [switch]$WhatIf
        )

        function Invoke-Monitoring {
            Write-Host "Monitoring O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Green

            try {
                $valueName = "DisableBloggingControl"
                $expectedValue = 1  # 1 = Disabled, 0 = Enabled

                if (-not (Test-Path $RegistryPath)) {
                    Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
                    return $false
                }

                $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

                if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
                    Write-Host "✓ Control compliant: DisableBloggingControl = $expectedValue (Blogging disabled)" -ForegroundColor Green
                    return $true
                }
                else {
                    $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
                    Write-Host "✗ Control non-compliant: DisableBloggingControl = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
                    return $false
                }
            }
            catch {
                Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }

        function Invoke-Remediation {
            Write-Host "Remediating O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Yellow

            try {
                if (-not (Test-Path $RegistryPath)) {
                    New-Item -Path $RegistryPath -Force | Out-Null
                }

                Set-ItemProperty -Path $RegistryPath -Name "DisableBloggingControl" -Value 1 -Type DWord -Force
                Write-Host "✓ Registry value set successfully: DisableBloggingControl = 1 (Blogging disabled)" -ForegroundColor Green

                Start-Sleep -Seconds 1
                return Invoke-Monitoring
            }
            catch {
                Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }


        function Invoke-Revert {
            Write-Host "Reverting O365-CO-000025: Blogging functionality must be disabled in all Office applications
" -ForegroundColor Yellow
    
            try {
                if ($WhatIf) {
                    Write-Host "  [WhatIf] Would remove registry value" -ForegroundColor Cyan
                    return $true
                }
        
                $valueName = "DisableBloggingControl"
        
                if (Test-Path $RegistryPath) {
                    Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
                    Write-Host "  Removed registry value: $valueName" -ForegroundColor Green
                }
        
                return $true
            }
            catch {
                Write-Host "  Error during revert: # Control: O365-CO-000025 - Blogging functionality must be disabled in all Office applications
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Green

    try {
        $valueName = "DisableBloggingControl"
        $expectedValue = 1  # 1 = Disabled, 0 = Enabled

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: DisableBloggingControl = $expectedValue (Blogging disabled)" -ForegroundColor Green
            return $true
        } else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: DisableBloggingControl = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    } catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "DisableBloggingControl" -Value 1 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: DisableBloggingControl = 1 (Blogging disabled)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    } catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

if ($Monitoring) {
    $result = Invoke-Monitoring
    exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
    $result = Invoke-Remediation
    exit $(if ($result) { 0 } else { 1 })
} else {
    Write-Host "Usage: .\control-blogging-disabled.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
    Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
    Write-Host "> Microsoft Office 2016 > Miscellaneous > Control Blogging: Enabled, All Blogging Disabled" -ForegroundColor White
}" -ForegroundColor Red
                return $false
            }
        }

        # Main execution
        try {
            if ($Monitoring) {
                $result = Invoke-Monitoring
                exit $(if ($result) { 0 } else { 1 })
            }
            elseif ($Remediation) {
                $result = Invoke-Remediation
                exit $(if ($result) { 0 } else { 1 })
            }
            else {
                Write-Host "Usage: .\control-blogging-disabled.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
                Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
                Write-Host "> Microsoft Office 2016 > Miscellaneous > Control Blogging: Enabled, All Blogging Disabled" -ForegroundColor White
            }" -ForegroundColor Red
    exit 1
}" -ForegroundColor Red
            return $false
        }
    }

    # Main execution
    try {
        if ($Monitoring) {
            $result = Invoke-Monitoring
            exit $(if ($result) { 0 } else { 1 })
        }
        elseif ($Remediation) {
            $result = Invoke-Remediation
            exit $(if ($result) { 0 } else { 1 })
        }
        elseif ($Revert) {
            $result = Invoke-Revert
            exit $(if ($result) { 0 } else { 1 })
        }
        else {
            Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
        }
    }
    catch {
        Write-Host "Script execution error: # Control: O365-CO-000025 - Blogging functionality must be disabled in all Office applications
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3

param(
    [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
    [switch]$Monitoring,
    [switch]$Remediation,
    [switch]$Revert,
    [switch]$WhatIf
)

function Invoke-Monitoring {
    Write-Host "Monitoring O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Green

    try {
        $valueName = "DisableBloggingControl"
        $expectedValue = 1  # 1 = Disabled, 0 = Enabled

        if (-not (Test-Path $RegistryPath)) {
            Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
            return $false
        }

        $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

        if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
            Write-Host "✓ Control compliant: DisableBloggingControl = $expectedValue (Blogging disabled)" -ForegroundColor Green
            return $true
        } else {
            $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
            Write-Host "✗ Control non-compliant: DisableBloggingControl = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
            return $false
        }
    } catch {
        Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}

function Invoke-Remediation {
    Write-Host "Remediating O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Yellow

    try {
        if (-not (Test-Path $RegistryPath)) {
            New-Item -Path $RegistryPath -Force | Out-Null
        }

        Set-ItemProperty -Path $RegistryPath -Name "DisableBloggingControl" -Value 1 -Type DWord -Force
        Write-Host "✓ Registry value set successfully: DisableBloggingControl = 1 (Blogging disabled)" -ForegroundColor Green

        Start-Sleep -Seconds 1
        return Invoke-Monitoring
    } catch {
        Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
        return $false
    }
}


function Invoke-Revert {
    Write-Host "Reverting O365-CO-000025: Blogging functionality must be disabled in all Office applications
        " -ForegroundColor Yellow
    
    try {
        if ($WhatIf) {
            Write-Host "  [WhatIf] Would remove registry value" -ForegroundColor Cyan
            return $true
        }
        
        $valueName = "DisableBloggingControl"
        
        if (Test-Path $RegistryPath) {
            Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
            Write-Host "  Removed registry value: $valueName" -ForegroundColor Green
        }
        
        return $true
    } catch {
        Write-Host "  Error during revert: # Control: O365-CO-000025 - Blogging functionality must be disabled in all Office applications
        #Requires -Version 5.1
        # DISA STIG Microsoft Office 365 ProPlus v3r3

        param(
            [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
            [switch]$Monitoring,
            [switch]$Remediation,
            [switch]$Revert,
            [switch]$WhatIf
        )

        function Invoke-Monitoring {
            Write-Host "Monitoring O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Green

            try {
                $valueName = "DisableBloggingControl"
                $expectedValue = 1  # 1 = Disabled, 0 = Enabled

                if (-not (Test-Path $RegistryPath)) {
                    Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
                    return $false
                }

                $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue

                if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
                    Write-Host "✓ Control compliant: DisableBloggingControl = $expectedValue (Blogging disabled)" -ForegroundColor Green
                    return $true
                }
                else {
                    $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
                    Write-Host "✗ Control non-compliant: DisableBloggingControl = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
                    return $false
                }
            }
            catch {
                Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }

        function Invoke-Remediation {
            Write-Host "Remediating O365-CO-000025: Blogging functionality must be disabled" -ForegroundColor Yellow

            try {
                if (-not (Test-Path $RegistryPath)) {
                    New-Item -Path $RegistryPath -Force | Out-Null
                }

                Set-ItemProperty -Path $RegistryPath -Name "DisableBloggingControl" -Value 1 -Type DWord -Force
                Write-Host "✓ Registry value set successfully: DisableBloggingControl = 1 (Blogging disabled)" -ForegroundColor Green

                Start-Sleep -Seconds 1
                return Invoke-Monitoring
            }
            catch {
                Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
                return $false
            }
        }

        if ($Monitoring) {
            $result = Invoke-Monitoring
            exit $(if ($result) { 0 } else { 1 })
        }
        elseif ($Remediation) {
            $result = Invoke-Remediation
            exit $(if ($result) { 0 } else { 1 })
        }
        else {
            Write-Host "Usage: .\control-blogging-disabled.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
            Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
            Write-Host "> Microsoft Office 2016 > Miscellaneous > Control Blogging: Enabled, All Blogging Disabled" -ForegroundColor White
        }" -ForegroundColor Red
        return $false
    }
}

# Main execution
try {
    if ($Monitoring) {
    $result = Invoke-Monitoring
    exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
    $result = Invoke-Remediation
    exit $(if ($result) { 0 } else { 1 })
} else {
    Write-Host "Usage: .\control-blogging-disabled.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
    Write-Host "Manual configuration: Group Policy > User Configuration > Administrative Templates" -ForegroundColor Cyan
    Write-Host "> Microsoft Office 2016 > Miscellaneous > Control Blogging: Enabled, All Blogging Disabled" -ForegroundColor White
}" -ForegroundColor Red
        exit 1
    }

Risico zonder implementatie

High: No auth tracking.

Management Samenvatting

Schakel in audit logging.

Implementatietijd: 2 uur
FTE required: 0.01 FTE

Control Blogging Disabled

💼 Management Samenvatting

Implementatie

Vereisten

Implementatie

monitoring

Remediatie

Compliance en Auditing

Compliance & Frameworks

Automation

Risico zonder implementatie

Management Samenvatting

Share artikel