Ensure 'Authentication with Exchange server' is set to 'Enabled: Kerberos Password Authentication'

YüksekDüzey 1Otomatikintune-office

Açıklama

This policy setting controls which authentication method Outlook uses to authenticate with an on-premises Microsoft Exchange Server. NOTE: - Exchange Server supports the Kerberos authentication protocol and NTLM for authentication. The Kerberos protocol is the more secure authentication method and is supported on Windows 2000 Server and later versions. NTLM authentication is supported in pre-Windows 2000 environments. Policy setting options for controlling how Outlook authenticates with Microsoft Exchange Server: Kerberos Password Authentication - Outlook attempts to authenticate using the Kerberos protocol only. ... Audit: reads the registry value(s) authenticationservice that the Intune policy writes for every loaded user profile (HKEY_USERS) and prints compliant only when each satisfies the benchmark value.

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$bad = @(); $bad += @(Get-ChildItem Registry::HKEY_USERS | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $v = (Get-ItemProperty -Path ('Registry::HKEY_USERS\' + $_.PSChildName + '\SOFTWARE\Policies\Microsoft\office\16.0\outlook\security') -Name 'authenticationservice' -ErrorAction SilentlyContinue).'authenticationservice'; if (-not ($null -ne $v -and @(16) -contains [int64]$v)) { $_.PSChildName + ':authenticationservice=' + $v } }); if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To establish the recommended state via configuration profiles, set the following Settings Catalog path to Enabled: Kerberos/NTLM Password Authentication: Microsoft Outlook 2016\Security\Security Form Settings\Outlook Security Mode > Authentication with Exchange Server Warning: When configuring on Outlook clients that connect to Exchange Online (365), this setting must be set to Disabled or left unconfigured. Important: For this setting to apply, the Outlook Security Mode setting must be enabled in Microsoft Outlook 2016\Security\Security Form Settings with Use Outlook Security Group Policy selected, as set in this benchmark.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: intune-officeintuneregistry
Referans: CIS Microsoft Intune for Office Benchmark v1.1.0 - 2.5.14.3.9 Ensure 'Authentication with Exchange server' is set to 'Enabled: Kerberos Password Authentication'

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target intune-office