Load Regelt Forms3

πŸ’Ό Management Samenvatting

Deze security regelen waarborgt de correcte configuratie van beveiligingsinstellingen op Windows endpoints.

Aanbeveling
IMPLEMENT
Risico zonder
High
Risk Score
7/10
Implementatie
2u (tech: 1u)
Van toepassing op:
βœ“ Windows

Deze instelling is onderdeel van de Windows security baseline en beschermt tegen bekende aanvalsvectoren door het afdwingen van veilige configuraties.

PowerShell Modules Vereist
Primary API: Graph
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Dit regelen configureert load regelt forms3 via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.

Vereisten

office

Implementatie

Gebruik PowerShell-script load-controls-forms3.ps1 (functie Invoke-Monitoring) – Monitoren.

monitoring

Gebruik PowerShell-script load-controls-forms3.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script load-controls-forms3.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance en Auditing

Beleid documentatie

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
# Control: O365-CO-000013 - The load of controls in Forms3 must be blocked #Requires -Version 5.1 # DISA STIG Microsoft Office 365 ProPlus v3r3 param( [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security", [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Function for monitoring the control function Invoke-Monitoring { Write-Host "Monitoring O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Green try { $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Blocked, 1 = Safe Mode, 0 = All enabled # Check if registry path exists if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry path does not exist: $RegistryPath" -ForegroundColor Red return $false } # Check the current value $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$valueName -eq $expectedValue) { Write-Host "βœ“ Control compliant: LoadControlsInForms = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: LoadControlsInForms = $actualValue (Expected: $expectedValue - Forms3 controls should be blocked)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Function for remediation function Invoke-Remediation { Write-Host "Remediating O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Yellow try { # Check if registry path exists, create if not if (-not (Test-Path $RegistryPath)) { Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } # Set the registry value to block Forms3 controls $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Block Forms3 controls Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force Write-Host "βœ“ Registry value set successfully: $valueName = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green # Verify the setting Start-Sleep -Seconds 1 $complianceResult = Invoke-Monitoring return $complianceResult } catch { Write-Host "βœ— Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Main execution function Invoke-Revert { Write-Host "Reverting O365-CO-000013: The load of controls in Forms3 must be blocked " -ForegroundColor Yellow try { if ($WhatIf) { Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan return $true } $valueName = "LoadControlsInForms" if (Test-Path $RegistryPath) { Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue Write-Host " Removed registry value: $valueName" -ForegroundColor Green } return $true } catch { Write-Host " Error during revert: # Control: O365-CO-000013 - The load of controls in Forms3 must be blocked #Requires -Version 5.1 # DISA STIG Microsoft Office 365 ProPlus v3r3 param( [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security", [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Function for monitoring the control function Invoke-Monitoring { Write-Host "Monitoring O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Green try { $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Blocked, 1 = Safe Mode, 0 = All enabled # Check if registry path exists if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry path does not exist: $RegistryPath" -ForegroundColor Red return $false } # Check the current value $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$valueName -eq $expectedValue) { Write-Host "βœ“ Control compliant: LoadControlsInForms = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: LoadControlsInForms = $actualValue (Expected: $expectedValue - Forms3 controls should be blocked)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Function for remediation function Invoke-Remediation { Write-Host "Remediating O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Yellow try { # Check if registry path exists, create if not if (-not (Test-Path $RegistryPath)) { Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } # Set the registry value to block Forms3 controls $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Block Forms3 controls Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force Write-Host "βœ“ Registry value set successfully: $valueName = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green # Verify the setting Start-Sleep -Seconds 1 $complianceResult = Invoke-Monitoring return $complianceResult } catch { Write-Host "βœ— Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Main execution if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } elseif ($Revert) { $result = Invoke-Revert exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow } } catch { Write-Host "Script execution error: # Control: O365-CO-000013 - The load of controls in Forms3 must be blocked #Requires -Version 5.1 # DISA STIG Microsoft Office 365 ProPlus v3r3 param( [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security", [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Function for monitoring the control function Invoke-Monitoring { Write-Host "Monitoring O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Green try { $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Blocked, 1 = Safe Mode, 0 = All enabled # Check if registry path exists if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry path does not exist: $RegistryPath" -ForegroundColor Red return $false } # Check the current value $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$valueName -eq $expectedValue) { Write-Host "βœ“ Control compliant: LoadControlsInForms = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: LoadControlsInForms = $actualValue (Expected: $expectedValue - Forms3 controls should be blocked)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Function for remediation function Invoke-Remediation { Write-Host "Remediating O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Yellow try { # Check if registry path exists, create if not if (-not (Test-Path $RegistryPath)) { Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } # Set the registry value to block Forms3 controls $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Block Forms3 controls Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force Write-Host "βœ“ Registry value set successfully: $valueName = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green # Verify the setting Start-Sleep -Seconds 1 $complianceResult = Invoke-Monitoring return $complianceResult } catch { Write-Host "βœ— Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Main execution function Invoke-Revert { Write-Host "Reverting O365-CO-000013: The load of controls in Forms3 must be blocked " -ForegroundColor Yellow try { if ($WhatIf) { Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan return $true } $valueName = "LoadControlsInForms" if (Test-Path $RegistryPath) { Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue Write-Host " Removed registry value: $valueName" -ForegroundColor Green } return $true } catch { Write-Host " Error during revert: # Control: O365-CO-000013 - The load of controls in Forms3 must be blocked #Requires -Version 5.1 # DISA STIG Microsoft Office 365 ProPlus v3r3 param( [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security", [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Function for monitoring the control function Invoke-Monitoring { Write-Host "Monitoring O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Green try { $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Blocked, 1 = Safe Mode, 0 = All enabled # Check if registry path exists if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry path does not exist: $RegistryPath" -ForegroundColor Red return $false } # Check the current value $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$valueName -eq $expectedValue) { Write-Host "βœ“ Control compliant: LoadControlsInForms = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: LoadControlsInForms = $actualValue (Expected: $expectedValue - Forms3 controls should be blocked)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Function for remediation function Invoke-Remediation { Write-Host "Remediating O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Yellow try { # Check if registry path exists, create if not if (-not (Test-Path $RegistryPath)) { Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } # Set the registry value to block Forms3 controls $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Block Forms3 controls Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force Write-Host "βœ“ Registry value set successfully: $valueName = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green # Verify the setting Start-Sleep -Seconds 1 $complianceResult = Invoke-Monitoring return $complianceResult } catch { Write-Host "βœ— Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Main execution if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Usage: .\load-controls-forms3.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White Write-Host "" Write-Host "Manual configuration:" -ForegroundColor Cyan Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White Write-Host "> Application Settings > Security Settings" -ForegroundColor White Write-Host "> Load Controls in Forms3: Enabled, Value = 4 (Blocked)" -ForegroundColor White } " -ForegroundColor Red return $false } } # Main execution try { if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Usage: .\load-controls-forms3.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White Write-Host "" Write-Host "Manual configuration:" -ForegroundColor Cyan Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White Write-Host "> Application Settings > Security Settings" -ForegroundColor White Write-Host "> Load Controls in Forms3: Enabled, Value = 4 (Blocked)" -ForegroundColor White } " -ForegroundColor Red exit 1 } " -ForegroundColor Red return $false } } # Main execution try { if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } elseif ($Revert) { $result = Invoke-Revert exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow } } catch { Write-Host "Script execution error: # Control: O365-CO-000013 - The load of controls in Forms3 must be blocked #Requires -Version 5.1 # DISA STIG Microsoft Office 365 ProPlus v3r3 param( [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security", [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Function for monitoring the control function Invoke-Monitoring { Write-Host "Monitoring O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Green try { $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Blocked, 1 = Safe Mode, 0 = All enabled # Check if registry path exists if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry path does not exist: $RegistryPath" -ForegroundColor Red return $false } # Check the current value $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$valueName -eq $expectedValue) { Write-Host "βœ“ Control compliant: LoadControlsInForms = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: LoadControlsInForms = $actualValue (Expected: $expectedValue - Forms3 controls should be blocked)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Function for remediation function Invoke-Remediation { Write-Host "Remediating O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Yellow try { # Check if registry path exists, create if not if (-not (Test-Path $RegistryPath)) { Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } # Set the registry value to block Forms3 controls $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Block Forms3 controls Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force Write-Host "βœ“ Registry value set successfully: $valueName = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green # Verify the setting Start-Sleep -Seconds 1 $complianceResult = Invoke-Monitoring return $complianceResult } catch { Write-Host "βœ— Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Main execution function Invoke-Revert { Write-Host "Reverting O365-CO-000013: The load of controls in Forms3 must be blocked " -ForegroundColor Yellow try { if ($WhatIf) { Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan return $true } $valueName = "LoadControlsInForms" if (Test-Path $RegistryPath) { Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue Write-Host " Removed registry value: $valueName" -ForegroundColor Green } return $true } catch { Write-Host " Error during revert: # Control: O365-CO-000013 - The load of controls in Forms3 must be blocked #Requires -Version 5.1 # DISA STIG Microsoft Office 365 ProPlus v3r3 param( [string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\Common\Security", [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Function for monitoring the control function Invoke-Monitoring { Write-Host "Monitoring O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Green try { $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Blocked, 1 = Safe Mode, 0 = All enabled # Check if registry path exists if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry path does not exist: $RegistryPath" -ForegroundColor Red return $false } # Check the current value $currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$valueName -eq $expectedValue) { Write-Host "βœ“ Control compliant: LoadControlsInForms = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: LoadControlsInForms = $actualValue (Expected: $expectedValue - Forms3 controls should be blocked)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Function for remediation function Invoke-Remediation { Write-Host "Remediating O365-CO-000013: The load of controls in Forms3 must be blocked" -ForegroundColor Yellow try { # Check if registry path exists, create if not if (-not (Test-Path $RegistryPath)) { Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } # Set the registry value to block Forms3 controls $valueName = "LoadControlsInForms" $expectedValue = 4 # 4 = Block Forms3 controls Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force Write-Host "βœ“ Registry value set successfully: $valueName = $expectedValue (Forms3 controls blocked)" -ForegroundColor Green # Verify the setting Start-Sleep -Seconds 1 $complianceResult = Invoke-Monitoring return $complianceResult } catch { Write-Host "βœ— Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Main execution if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Usage: .\load-controls-forms3.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White Write-Host "" Write-Host "Manual configuration:" -ForegroundColor Cyan Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White Write-Host "> Application Settings > Security Settings" -ForegroundColor White Write-Host "> Load Controls in Forms3: Enabled, Value = 4 (Blocked)" -ForegroundColor White } " -ForegroundColor Red return $false } } # Main execution try { if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Usage: .\load-controls-forms3.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White Write-Host "" Write-Host "Manual configuration:" -ForegroundColor Cyan Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft Office 2016" -ForegroundColor White Write-Host "> Application Settings > Security Settings" -ForegroundColor White Write-Host "> Load Controls in Forms3: Enabled, Value = 4 (Blocked)" -ForegroundColor White } " -ForegroundColor Red exit 1 }

Risico zonder implementatie

Risico zonder implementatie
High: No auth tracking.

Management Samenvatting

Schakel in audit logging.