Intune: Microsoft Office
TMA-INTUNE-OFFICE-2.3.27.17
Ensure 'Protect document metadata for password protected files' is set to 'Enabled'
Description
This policy setting determines whether metadata is encrypted when an Office Open XML file is password protected. The recommended state for this setting is: Enabled. Audit: reads the registry value(s) openxmlencryptproperty that the Intune policy writes for every loaded user profile (HKEY_USERS) and prints compliant only when each satisfies the benchmark value.
How it is checked
Audit method: Windows registry
$bad = @(); $bad += @(Get-ChildItem Registry::HKEY_USERS | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $v = (Get-ItemProperty -Path ('Registry::HKEY_USERS\' + $_.PSChildName + '\SOFTWARE\Policies\Microsoft\office\16.0\common\security') -Name 'openxmlencryptproperty' -ErrorAction SilentlyContinue).'openxmlencryptproperty'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $_.PSChildName + ':openxmlencryptproperty=' + $v } }); if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
To establish the recommended state via configuration profiles, set the following Settings Catalog path to Enabled: Microsoft Office 2016\Security Settings\Protect document metadata for password protected files
Properties
- Operating systems
- Any
- Tags
- intune-officeintuneregistry
- Reference
- CIS Microsoft Intune for Office Benchmark v1.1.0 - 2.3.27.17 Ensure 'Protect document metadata for password protected files' is set to 'Enabled'
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target intune-office