Ensure 'Restrict legacy JScript execution for Office' is set to 'Enabled'

SedangLevel 1Otomatisintune-office

Deskripsi

This policy setting controls JScript execution per Security Zone within Internet Explorer and WebBrowser Control (WebOC) for Office applications. JScript is Microsoft's legacy dialect of the ECMAScript standard that is used in Microsoft's Internet Explorer 11 and older. If Enabled, Office applications will not execute legacy JScript for the Internet or Restricted Sites zones and users aren’t notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones. ... Audit: reads the registry value(s) excel.exe, msaccess.exe, mspub.exe, onenote.exe, outlook.exe, powerpnt.exe, visio.exe, winproj.exe, winword.exe that the Intune policy writes under HKEY_LOCAL_MACHINE and prints compliant only when each satisfies the benchmark value.

Cara pemeriksaan

Metode audit: Registry Windows

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'excel.exe' -ErrorAction SilentlyContinue).'excel.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'excel.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'msaccess.exe' -ErrorAction SilentlyContinue).'msaccess.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'msaccess.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'mspub.exe' -ErrorAction SilentlyContinue).'mspub.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'mspub.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'onenote.exe' -ErrorAction SilentlyContinue).'onenote.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'onenote.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'outlook.exe' -ErrorAction SilentlyContinue).'outlook.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'outlook.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue).'powerpnt.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'powerpnt.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'visio.exe' -ErrorAction SilentlyContinue).'visio.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'visio.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winproj.exe' -ErrorAction SilentlyContinue).'winproj.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'winproj.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winword.exe' -ErrorAction SilentlyContinue).'winword.exe'; if (-not ($null -ne $v -and @(69632) -contains [int64]$v)) { $bad += 'winword.exe=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To establish the recommended state via configuration profiles, set the following Settings Catalog path to Enabled: 69632 for each application listed. Administrative Templates\MS Security Guide\Restrict legacy JScript execution for Office

Properti

Sistem operasi: Apa saja
Tag: intune-officeintuneregistry
Referensi: CIS Microsoft Intune for Office Benchmark v1.1.0 - 1.1.1.2 Ensure 'Restrict legacy JScript execution for Office' is set to 'Enabled'

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target intune-office