Ensure 'Signature Warning' is set to 'Enabled: Always warn about invalid signatures'

高レベル 1自動intune-office

説明

This policy setting controls how Outlook warns users about messages with invalid digital signatures. The recommended state for this setting is: Enabled: Always warn about invalid signatures. Audit: reads the registry value(s) warnaboutinvalid that the Intune policy writes for every loaded user profile (HKEY_USERS) and prints compliant only when each satisfies the benchmark value.

チェック方法

監査方法: Windows レジストリ

registry

$bad = @(); $bad += @(Get-ChildItem Registry::HKEY_USERS | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $v = (Get-ItemProperty -Path ('Registry::HKEY_USERS\' + $_.PSChildName + '\SOFTWARE\Policies\Microsoft\office\16.0\outlook\security') -Name 'warnaboutinvalid' -ErrorAction SilentlyContinue).'warnaboutinvalid'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $_.PSChildName + ':warnaboutinvalid=' + $v } }); if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

To establish the recommended state via configuration profiles, set the following Settings Catalog path to Enabled: Always warn about invalid signatures: Microsoft Outlook 2016\Security\Security Form Settings\Outlook Security Mode > Signature Warning Important: For this setting to apply, the Outlook Security Mode setting must be enabled in Microsoft Outlook 2016\Security\Security Form Settings with Use Outlook Security Group Policy selected, as set in this benchmark.

プロパティ

オペレーティングシステム: すべて
タグ: intune-officeintuneregistry
参照: CIS Microsoft Intune for Office Benchmark v1.1.0 - 2.5.14.3.30 Ensure 'Signature Warning' is set to 'Enabled: Always warn about invalid signatures'

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target intune-office