Dit regelen Configureerert Schakel uit optin wizard via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.
Vereisten
office
Implementeeratie
Gebruik PowerShell-script Schakel uit-optin-wizard.ps1 (functie Invoke-Monitoring) β Monitoren.
monitoring
Gebruik PowerShell-script disable-optin-wizard.ps1 (functie Invoke-Monitoring) β Controleren.
Remediatie
Gebruik PowerShell-script disable-optin-wizard.ps1 (functie Invoke-Remediation) β Herstellen.
Compliance en Auditing
Beleid documentatie
Compliance & Frameworks
CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
<#
.SYNOPSIS
Opt-in Wizard on first run must be disabled
.DESCRIPTION
Implementation for Opt-in Wizard on first run must be disabled
.NOTES
Filename: disable-optin-wizard.ps1
Author: Nederlandse Baseline voor Veilige Cloud
Version: 1.0
Related JSON: content/office/office-shared/disable-optin-wizard.json
#>#Requires -Version 5.1#Requires -Modules Microsoft.Graph
[CmdletBinding()]
param(
[Parameter()][switch]$WhatIf,
[Parameter()][switch]$Monitoring,
[Parameter()][switch]$Remediation,
[Parameter()][switch]$Revert
)
$ErrorActionPreference = 'Stop'
$VerbosePreference = 'Continue'
$PolicyName = "Opt-in Wizard on first run must be disabled"
$CISControl = "2.3.25.1.3"
function Connect-RequiredServices {
# Connection logic based on API
}
functionTest-Compliance {
Write-Verbose "Testing compliance for: $PolicyName..."
$result = [PSCustomObject]@{
ScriptName = "disable-optin-wizard"
PolicyName = $PolicyName
IsCompliant = $false
TotalResources = 0
CompliantCount = 0
NonCompliantCount = 0
Details = @()
Recommendations = @()
}
# Compliance check implementation# Based on: $result.Details += "Compliance check - implementation required based on control"
$result.NonCompliantCount = 1return$result
}
function Invoke-Remediation {
Write-Host "`nApplying remediation for: $PolicyName..." -ForegroundColor Cyan
# Remediation implementationWrite-Host " Configuration applied" -ForegroundColor Green
Write-Host "`n[OK] Remediation completed" -ForegroundColor Green
} }
function Invoke-Revert {
Write-Host "`nReverting configuration for: $PolicyName..." -ForegroundColor Cyan
# Revert implementationWrite-Host " Configuration reverted" -ForegroundColor Green
Write-Host "`n[OK] Revert completed" -ForegroundColor Green
function Invoke-Monitoring {
$result = Test-ComplianceWrite-Host "`n========================================" -ForegroundColor Cyan
Write-Host "$PolicyName" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan
Write-Host "Total: $($result.TotalResources)" -ForegroundColor White
Write-Host "Compliant: $($result.CompliantCount)" -ForegroundColor Green
$color = if ($result.NonCompliantCount -gt 0) { "Red" } else { "Green" }
Write-Host "Non-compliant: $($result.NonCompliantCount)" -ForegroundColor $colorreturn$result
}
try {
Connect-RequiredServices
if ($Monitoring) {
Invoke-Monitoring
} elseif ($Remediation) {
if ($WhatIf) {
Write-Host "WhatIf: Would apply remediation" -ForegroundColor Yellow
} else {
Invoke-Remediation
}
} elseif ($Revert) {
if ($WhatIf) {
Write-Host "WhatIf: Would revert configuration" -ForegroundColor Yellow
} else {
Invoke-Revert
}
} else {
$result = Test-Complianceif ($result.IsCompliant) {
Write-Host "`n[OK] COMPLIANT" -ForegroundColor Green
} else {
Write-Host "`n[FAIL] NON-COMPLIANT" -ForegroundColor Red
}
}
} catch {
Write-Error$_
}