TMA-INTUNE-OFFICE-1.2.5.1.5
Ensure 'Information Bar' is set to 'Enabled'
中级别 1自动化intune-office
说明
This policy setting determines whether the Information Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information Bar is displayed for Internet Explorer processes. The recommended state for this setting is: Enabled: groove.exe, excel.exe, mspub.exe, powerpnt.exe, pptview.exe, visio.exe, winproj.exe, winword.exe, outlook.exe, spDesign.exe, exprwd.exe, msaccess.exe, onent.exe, mse7.exe. Audit: reads the registry value(s) excel.exe, exprwd.exe, groove.exe, msaccess.exe, mse7.exe, mspub.exe, onent.exe, outlook.exe, powerpnt.exe, pptview.exe, spDesign.exe, visio.exe, winproj.exe, winword.exe that the Intune policy writes under HKEY_LOCAL_MACHINE and prints compliant only when each satisfies the benchmark value.
检查方式
审计方法: Windows 注册表
registry
$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'groove.exe' -ErrorAction SilentlyContinue).'groove.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'groove.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'excel.exe' -ErrorAction SilentlyContinue).'excel.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'excel.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'mspub.exe' -ErrorAction SilentlyContinue).'mspub.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mspub.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue).'powerpnt.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'powerpnt.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'pptview.exe' -ErrorAction SilentlyContinue).'pptview.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'pptview.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'visio.exe' -ErrorAction SilentlyContinue).'visio.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'visio.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'winproj.exe' -ErrorAction SilentlyContinue).'winproj.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winproj.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'winword.exe' -ErrorAction SilentlyContinue).'winword.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winword.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'outlook.exe' -ErrorAction SilentlyContinue).'outlook.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'outlook.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'spDesign.exe' -ErrorAction SilentlyContinue).'spDesign.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'spDesign.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'exprwd.exe' -ErrorAction SilentlyContinue).'exprwd.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'exprwd.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'msaccess.exe' -ErrorAction SilentlyContinue).'msaccess.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'msaccess.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'onent.exe' -ErrorAction SilentlyContinue).'onent.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'onent.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND' -Name 'mse7.exe' -ErrorAction SilentlyContinue).'mse7.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mse7.exe=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }- 预期输出
compliant
修复方式
修复方法: 操作指南或基础设施补丁
To establish the recommended state via configuration profiles, set the following Settings Catalog path to Enabled: check all applications: Microsoft Office 2016 (Machine)\Security Settings\IE Security\Information Bar
属性
- 操作系统
- 任意
- 标签
- intune-officeintuneregistry
- 参考
- CIS Microsoft Intune for Office Benchmark v1.1.0 - 1.2.5.1.5 Ensure 'Information Bar' is set to 'Enabled'
检查本机
请在您有权审计的机器上运行此命令。扫描为只读操作。
shell
tmaegis scan --target intune-office