PowerPoint: Disable Slide Update From Content Server

πŸ’Ό Management Samenvatting

Disable PowerPoint slide update from content server - prevents automatic slide replacement from SharePoint Slide Library (tampering risk).

Aanbeveling
IMPLEMENT
Risico zonder
Medium
Risk Score
5/10
Implementatie
2u (tech: 1u)
Van toepassing op:
βœ“ Microsoft PowerPoint

Slide Library = auto-update risk: Slide Library: SharePoint feature (centralized slide repository), Linked slides: PowerPoint embeds slides from Slide Library (URL reference), Auto-update: When Slide Library slide changes β†’ PowerPoint auto-updates local copy (NO user prompt), Attack: Compromised Slide Library β†’ attacker modifies slide β†’ ALL presentations with linked slide auto-update (content tampering). Risk: Phishing: Change branded slide to phishing URL (all presentations affected), Misinformation: Change financial data (integrity attack), Malicious content: Insert malware download link. Disable auto-update: Manual update ONLY (user reviews changes before applying).

PowerShell Modules Vereist
Primary API: Intune / GPO
Connection: Registry-based
Required Modules:

Implementatie

Disable slide update: Policy: Disable the Office client from polling the SharePoint Server for published links: Enabled, Effect: Slide Library updates: Manual ONLY (user clicks 'Check for Updates'), Auto-update: BLOCKED (no silent slide replacement), User control: Reviews changes before applying.

Vereisten

  1. PowerPoint 2016+
  2. SharePoint Slide Library (legacy feature - deprecated)
  3. Intune of GPO

Implementatie

Intune Settings Catalog: PowerPoint\Options\Advanced β†’ Disable the Office client from polling the SharePoint Server for published links: Enabled. Effect: Manual slide updates only (user-initiated).

Compliance

BIO 11.02 (Content integrity), ISO 27001 A.12.2.1.

Monitoring

Gebruik PowerShell-script disable-slide-update.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script disable-slide-update.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
<# .SYNOPSIS Schakelt automatische slide updates uit in PowerPoint .DESCRIPTION Dit script implementeert CIS control O365-PT-000001 voor het uitschakelen van automatische slide updates in Microsoft PowerPoint. Dit voorkomt dat presentaties automatisch worden bijgewerkt met externe content, wat een beveiligingsrisico kan vormen. .REQUIREMENTS - PowerShell 5.1 of hoger - Lokale administrator rechten voor registry wijzigingen - Microsoft PowerPoint geΓ―nstalleerd .PARAMETER Monitoring Controleert de huidige compliance status .PARAMETER Remediation Past de aanbevolen configuratie toe .PARAMETER Revert Herstelt de originele configuratie .PARAMETER WhatIf Toont wat er zou gebeuren zonder wijzigingen door te voeren .EXAMPLE .\disable-slide-update.ps1 -Monitoring Controleert of slide updates zijn uitgeschakeld .EXAMPLE .\disable-slide-update.ps1 -Remediation Schakelt automatische slide updates uit .NOTES Registry pad: HKCU:\Software\Policies\Microsoft\Office\16.0\POWERPOINT\Security Waarde: disableslideupdate = 1 CIS Control: O365-PT-000001 DISA STIG: Microsoft Office 365 ProPlus v3r3 #> #Requires -Version 5.1 param( [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Globale variabelen $RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\POWERPOINT\Security" $ValueName = "disableslideupdate" $ExpectedValue = 1 $ControlID = "O365-PT-000001" function Test-Compliance { try { if (-not (Test-Path $RegistryPath)) { return $false } $currentValue = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue return ($currentValue -and $currentValue.$ValueName -eq $ExpectedValue) } catch { return $false } } function Invoke-Monitoring { Write-Host "Monitoring ${ControlID}: Automatische slide updates uitschakelen" -ForegroundColor Green try { if (-not (Test-Path $RegistryPath)) { Write-Host "βœ— Registry pad bestaat niet: $RegistryPath" -ForegroundColor Red return $false } $currentValue = Get-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue if ($currentValue -and $currentValue.$ValueName -eq $ExpectedValue) { Write-Host "βœ“ Control compliant: ${ValueName} = $ExpectedValue" -ForegroundColor Green return $true } else { $actualValue = if ($currentValue) { $currentValue.$ValueName } else { "Not Set" } Write-Host "βœ— Control non-compliant: ${ValueName} = $actualValue (Expected: $ExpectedValue)" -ForegroundColor Red return $false } } catch { Write-Host "βœ— Fout bij controleren registry instelling: $($_.Exception.Message)" -ForegroundColor Red return $false } } function Invoke-Remediation { Write-Host "Remediating ${ControlID}: Automatische slide updates uitschakelen" -ForegroundColor Yellow try { if ($WhatIf) { Write-Host "WhatIf: Zou registry waarde instellen: ${ValueName} = $ExpectedValue" -ForegroundColor Cyan return $true } if (-not (Test-Path $RegistryPath)) { Write-Host "Registry pad aanmaken: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } Set-ItemProperty -Path $RegistryPath -Name $ValueName -Value $ExpectedValue -Type DWord -Force Write-Host "βœ“ Registry waarde succesvol ingesteld: ${ValueName} = $ExpectedValue" -ForegroundColor Green Start-Sleep -Seconds 1 return Invoke-Monitoring } catch { Write-Host "βœ— Fout bij configureren registry instelling: $($_.Exception.Message)" -ForegroundColor Red return $false } } function Invoke-Revert { Write-Host "Reverting ${ControlID}: Slide updates instelling herstellen" -ForegroundColor Yellow try { if ($WhatIf) { Write-Host "WhatIf: Zou registry waarde verwijderen: ${ValueName}" -ForegroundColor Cyan return $true } if (Test-Path $RegistryPath) { Remove-ItemProperty -Path $RegistryPath -Name $ValueName -ErrorAction SilentlyContinue Write-Host "βœ“ Registry waarde verwijderd: ${ValueName}" -ForegroundColor Green } return $true } catch { Write-Host "βœ— Fout bij herstellen registry instelling: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Hoofd uitvoering try { if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } elseif ($Revert) { $result = Invoke-Revert exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Gebruik: .\disable-slide-update.ps1 [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow Write-Host " -Monitoring: Controleer huidige compliance status" -ForegroundColor White Write-Host " -Remediation: Pas aanbevolen configuratie toe" -ForegroundColor White Write-Host " -Revert: Herstel originele configuratie" -ForegroundColor White Write-Host " -WhatIf: Toon wat er zou gebeuren" -ForegroundColor White } } catch { Write-Host "βœ— Onverwachte fout: $($_.Exception.Message)" -ForegroundColor Red exit 1 }

Risico zonder implementatie

Risico zonder implementatie
Medium: Medium: Auto slide updates = content tampering risk (compromised Slide Library).

Management Samenvatting

Disable PowerPoint auto slide updates (Slide Library). Manual updates only. Content integrity. Implementatie: 1-2 uur.