Dit regelen Configureerert Schakel uit sharepoint polling via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.
Vereisten
office
Implementeeratie
Gebruik PowerShell-script Schakel uit-sharepoint-polling.ps1 (functie Invoke-Monitoring) β Monitoren.
monitoring
Gebruik PowerShell-script disable-sharepoint-polling.ps1 (functie Invoke-Monitoring) β Controleren.
Remediatie
Gebruik PowerShell-script disable-sharepoint-polling.ps1 (functie Invoke-Remediation) β Herstellen.
Compliance en Auditing
Beleid documentatie
Compliance & Frameworks
CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
# Control: O365-CO-000003 - The Office client must be prevented from polling the SharePoint Server for published links#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Green
try {
$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disabled, 0 = Enabled# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: DisableSharePointPolling = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
return$true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: DisableSharePointPolling = $actualValue (Expected: $expectedValue - SharePoint polling should be disabled)" -ForegroundColor Red
return$false
}
}
catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to disable SharePoint polling$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disable SharePoint pollingSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
}
catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionfunction Invoke-Revert {
Write-Host "Reverting O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return$true
}
$valueName = "DisableSharePointPolling"
if (Test-Path$RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return$true
}
catch {
Write-Host " Error during revert: # Control: O365-CO-000003 - The Office client must be prevented from polling the SharePoint Server for published links#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Green
try {
$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disabled, 0 = Enabled# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: DisableSharePointPolling = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
return$true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: DisableSharePointPolling = $actualValue (Expected: $expectedValue - SharePoint polling should be disabled)" -ForegroundColor Red
return$false
}
} catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to disable SharePoint polling$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disable SharePoint pollingSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
} catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionif ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: # Control: O365-CO-000003 - The Office client must be prevented from polling the SharePoint Server for published links#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Green
try {
$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disabled, 0 = Enabled# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: DisableSharePointPolling = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
return$true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: DisableSharePointPolling = $actualValue (Expected: $expectedValue - SharePoint polling should be disabled)" -ForegroundColor Red
return$false
}
}
catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to disable SharePoint polling$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disable SharePoint pollingSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
}
catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionfunction Invoke-Revert {
Write-Host "Reverting O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return$true
}
$valueName = "DisableSharePointPolling"
if (Test-Path$RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return$true
}
catch {
Write-Host " Error during revert: # Control: O365-CO-000003 - The Office client must be prevented from polling the SharePoint Server for published links#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Green
try {
$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disabled, 0 = Enabled# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: DisableSharePointPolling = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
return$true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: DisableSharePointPolling = $actualValue (Expected: $expectedValue - SharePoint polling should be disabled)" -ForegroundColor Red
return$false
}
} catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to disable SharePoint polling$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disable SharePoint pollingSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
} catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionif ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
} else {
Write-Host "Usage: .\disable-sharepoint-polling.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings" -ForegroundColor White
Write-Host "> Disable the Office client from polling the SharePoint Server for published links: Enabled" -ForegroundColor White
}" -ForegroundColor Red
return$false
}
}
# Main executiontry {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: .\disable-sharepoint-polling.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings" -ForegroundColor White
Write-Host "> Disable the Office client from polling the SharePoint Server for published links: Enabled" -ForegroundColor White
}" -ForegroundColor Red
exit 1
}" -ForegroundColor Red
return$false
}
}
# Main executiontry {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: # Control: O365-CO-000003 - The Office client must be prevented from polling the SharePoint Server for published links#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Green
try {
$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disabled, 0 = Enabled# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: DisableSharePointPolling = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
return$true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: DisableSharePointPolling = $actualValue (Expected: $expectedValue - SharePoint polling should be disabled)" -ForegroundColor Red
return$false
}
} catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to disable SharePoint polling$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disable SharePoint pollingSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
} catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionfunction Invoke-Revert {
Write-Host "Reverting O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return$true
}
$valueName = "DisableSharePointPolling"
if (Test-Path$RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return$true
} catch {
Write-Host " Error during revert: # Control: O365-CO-000003 - The Office client must be prevented from polling the SharePoint Server for published links#Requires -Version 5.1# DISA STIG Microsoft Office 365 ProPlus v3r3param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\General",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
# Function for monitoring the controlfunction Invoke-Monitoring {
Write-Host "Monitoring O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Green
try {
$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disabled, 0 = Enabled# Check if registry path existsif (-not (Test-Path$RegistryPath)) {
Write-Host "β Registry path does not exist: $RegistryPath" -ForegroundColor Red
return$false
}
# Check the current value$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "β Control compliant: DisableSharePointPolling = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
return$true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "β Control non-compliant: DisableSharePointPolling = $actualValue (Expected: $expectedValue - SharePoint polling should be disabled)" -ForegroundColor Red
return$false
}
}
catch {
Write-Host "β Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Function for remediationfunction Invoke-Remediation {
Write-Host "Remediating O365-CO-000003: The Office client must be prevented from polling the SharePoint Server for published links" -ForegroundColor Yellow
try {
# Check if registry path exists, create if notif (-not (Test-Path$RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
# Set the registry value to disable SharePoint polling$valueName = "DisableSharePointPolling"
$expectedValue = 1# 1 = Disable SharePoint pollingSet-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "β Registry value set successfully: $valueName = $expectedValue (SharePoint polling disabled)" -ForegroundColor Green
# Verify the setting
Start-Sleep -Seconds 1$complianceResult = Invoke-Monitoring
return$complianceResult
}
catch {
Write-Host "β Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return$false
}
}
# Main executionif ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: .\disable-sharepoint-polling.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings" -ForegroundColor White
Write-Host "> Disable the Office client from polling the SharePoint Server for published links: Enabled" -ForegroundColor White
}" -ForegroundColor Red
return$false
}
}
# Main executiontry {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
} else {
Write-Host "Usage: .\disable-sharepoint-polling.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
Write-Host ""
Write-Host "Manual configuration:" -ForegroundColor Cyan
Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White
Write-Host "> Application Settings" -ForegroundColor White
Write-Host "> Disable the Office client from polling the SharePoint Server for published links: Enabled" -ForegroundColor White
}" -ForegroundColor Red
exit 1
}