Dans le cas où un appareil Windows Autopilot n'arrive pas à s'activer en utilisant la clé OEM intégrée, ceci peut être à cause d'un serveur KMS que l'appareil essaye de contacter sur le réseau local de l'entreprise (à cause d'une mauvaise masterisation).
Afin de corriger cela et activer Windows en utilisant la clé OEM intégrée, on peut utiliser un script de remédiation Intune.
Script de détection / remédiation :
$key = (Get-WmiObject -query 'select * from SoftwareLicensingService').OA3xOriginalProductKey
$KMSservice = Get-WMIObject -query "select * from SoftwareLicensingService"
$null = $KMSservice.InstallProductKey($key)
$null = $KMSservice.RefreshLicenseStatus()
Dans le cas des appareils dans l'AD OnPrem, Co-Managed et gérés par Intune, il est pratique d'avoir la clé BitLocker enregistrée dans Entra ID afin de la visualiser dans le portail Intune.
La sauvegarde de la clé BitLocker vers Entra ID est possible en utilisant un script de remédiation Intune.
Script de détection :
try{
$BLV = Get-BitLockerVolume -MountPoint $env:SystemDrive
$KeyProtectorID=""
foreach($keyProtector in $BLV.KeyProtector){
if($keyProtector.KeyProtectorType -eq "RecoveryPassword"){
$KeyProtectorID=$keyProtector.KeyProtectorId
break;
}
}
$result = BackupToAAD-BitLockerKeyProtector -MountPoint "$($env:SystemDrive)" -KeyProtectorId $KeyProtectorID -whatif
return $true
}
catch{
return $false
}
Script de remédiation :
try{
$BLV = Get-BitLockerVolume -MountPoint $env:SystemDrive
$KeyProtectorID=""
foreach($keyProtector in $BLV.KeyProtector){
if($keyProtector.KeyProtectorType -eq "RecoveryPassword"){
$KeyProtectorID=$keyProtector.KeyProtectorId
break;
}
}
$result = BackupToAAD-BitLockerKeyProtector -MountPoint "$($env:SystemDrive)" -KeyProtectorId $KeyProtectorID -whatif
return $true
}
catch{
return $false
}
Le script de remédiation Intune ci-dessous permettait de fixer le bug d'upgrade de Windows Pro à Enterprise via licence 365.
Script de détection / remédiation :
# Define the registry key path and value
$registryPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\MfaRequiredInClipRenew"
$registryValueName = "Verify Multifactor Authentication in ClipRenew"
$registryValueData = 0 # DWORD value of 0
$sid = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-4") # Interactive group SID
# Check if the registry key already exists
if (-not (Test-Path -Path $registryPath)) {
# If the key doesn't exist, create it and set the DWORD value
New-Item -Path $registryPath -Force | Out-Null
Set-ItemProperty -Path $registryPath -Name $registryValueName -Value $registryValueData -Type DWORD
Write-Output "Registry key created and DWORD value added."
} else {
Write-Output "Registry key already exists. No changes made."
}
# Add read permissions for SID (S-1-5-4, interactive users) to the registry key with inheritance
$acl = Get-Acl -Path $registryPath
$ruleSID = New-Object System.Security.AccessControl.RegistryAccessRule($sid, "FullControl", "ContainerInherit,ObjectInherit", "None", "Allow")
$acl.AddAccessRule($ruleSID)
Set-Acl -Path $registryPath -AclObject $acl
Write-Output "Added 'Interactive' group and SID ($sid) with read permissions (with inheritance) to the registry key."
# Start the scheduled task
Get-ScheduledTask -TaskName 'LicenseAcquisition' | Start-ScheduledTask
Write-Output "Scheduled task 'LicenseAcquisition' started."
Afin de désactiver le compte Administrateur local par défaut dans Windows, ceci peut être simple en utilisant un script de remédiation Intune.
Script de détection :
$user = (Get-WmiObject -Class Win32_UserAccount -Filter 'LocalAccount = True ' | Where-Object SID -Like 'S-1-5-*-500').Name
$Status= (Get-WmiObject -Class Win32_UserAccount -Filter 'LocalAccount = True ' | Where-Object SID -Like 'S-1-5-*-500').Disabled
if ($Status -eq $false)
{
Write-Host "$user is Enabled"
Exit 1
}
Else {
Write-Host "$user is not Enabled"
Exit 0
}
Script de remédiation :
$user = (Get-WmiObject -Class Win32_UserAccount -Filter 'LocalAccount = True ' | Where-Object SID -Like 'S-1-5-*-500').Name
$Status= (Get-WmiObject -Class Win32_UserAccount -Filter 'LocalAccount = True ' | Where-Object SID -Like 'S-1-5-*-500').Disabled
if ($Status -eq $false)
{
try{
NET USER $user /active:No
Exit 0
}
Catch {
Write-Host "$user is already Disabled"
Write-error $_
Exit 1
}
}
Else {
Write-Host "$user is already Disabled"
Exit 1
}
Par mesure de sécurité, il est conseillé de désactiver le "Webmail" dans Adobe Acrobat Reader.
Ceci est possible en utilisant un script de remédiation dans Intune.
Script de détection :
$regkey64 = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWebmailProfiles"
$regkey32 = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles"
$name = "bDisableWebmail"
try
{
$exists64 = Get-ItemProperty $regkey64 $name -ErrorAction SilentlyContinue
$exists32 = Get-ItemProperty $regkey32 $name -ErrorAction SilentlyContinue
#Write-Host "Test-RegistryValue: $exists"
if ((($exists64 -eq $null) -and ($exists32 -eq $null)) -or (($exists64.bDisableWebmail -ne 1) -and ($exists32.bDisableWebmail -ne 1)))
{
Write-Host "Webmail enabled"
exit 1
}
else
{
Write-Host "Webmail disabled"
exit 0
}
}
catch
{
return $false
}
Script de remédiation :
$regkey64 = "HKLM:\SOFTWARE\Policies\Adobe\Adobe Acrobat\DC\FeatureLockDown\cWebmailProfiles"
$regkey32 = "HKLM:\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown\cWebmailProfiles"
$name = "bDisableWebmail"
New-item -Path $regkey64 -ErrorAction SilentlyContinue
New-item -Path $regkey32 -ErrorAction SilentlyContinue
New-ItemProperty -Path $regkey64 -Name $name -Value "1" -PropertyType "DWORD" -Force -ErrorAction SilentlyContinue
New-ItemProperty -Path $regkey32 -Name $name -Value "1" -PropertyType "DWORD" -Force -ErrorAction SilentlyContinue
Avec l'arrivée du New Teams, les IT ont besoin d'inventorier les appareils Windows qui l'ont installé et qui l'utilisent.
Ceci est possible en utilisant un script de remédiation Intune, qui fera le check continu sur tous les appareils concernés.
Script de détection :
function Is-NewTeamsInstalled {
return (Get-AppxPackage *MSTeams* -ErrorAction SilentlyContinue) -ne $null
}
# Function to check if Microsoft Teams is the default IM app
function Is-NewTeamsDefault {
$registryPath = "HKCU:\Software\IM Providers"
$registryKey = "DefaultIMApp"
$defaultValue = Get-ItemProperty -Path $registryPath -Name $registryKey -ErrorAction SilentlyContinue
return ($defaultValue -ne $null) -and ($defaultValue.DefaultIMApp -eq "MSTeams")
}
# Main script logic
$teamsInstalled = Is-NewTeamsInstalled
$teamsDefault = Is-NewTeamsDefault
if ($teamsInstalled -and $teamsDefault) {
Write-Host "New Teams installed and is set Default!";Exit 0
}
elseif ($teamsInstalled -or $teamsDefault) {
Write-Host "New Teams installed but not set Default."
Exit 1
}
else {
Write-Host "New Teams not installed."
Exit 1
}
Afin de détecter les appareils Windows où l'option "Définir le fuseau horaire automatiquement" est désactivée, il suffit d'utiliser un script de remédiation Intune.
Script de détection :
$registrySettings = @(
@{ Path = "HKLM:\SYSTEM\CurrentControlSet\Services\tzautoupdate"; Name = "Start"; DesiredValue = 3 }
)
# test if the registry path exists
if ((Test-Path $registrySettings.Path)) {
# get the current value of the registry key
$currentValueTZauto = (Get-ItemProperty -Path $registrySettings.Path -ErrorAction SilentlyContinue).$($registrySettings.Name)
# If the current value is not the desired value, update it
if ($currentValueTZauto -ne $registrySettings.DesiredValue) {
Write-Host "the current value is Start=$currentValueTZauto, and it is not the desired value"
exit 1
} else {
# If the current value is already correct, do nothing
Write-Host "the current value is Start=$currentValueTZauto, and it is the desired value"
exit 0
}
} else {
# If the registry path does not exist, log a warning
Write-Warning "Registry path $($registrySettings.Path) does not exist."
exit 1
}
Afin de créer le compte admin local pour qui sera utilisé pour LAPS, nous pouvons utiliser un script de remédiation Intune.
Script de détection :
Start-Transcript -Path "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\LAPSLocalAdmin_Detect.log" -Append
$LAPSAdmin = "Laps"
$Query = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True"
$Group = Get-WmiObject -Query "Select * From Win32_Group Where LocalAccount = TRUE And SID = 'S-1-5-32-544'"
$Members=$group.GetRelated("win32_useraccount")
If ($Query.Name -notcontains $LAPSAdmin) {
Write-Output "User: $LAPSAdmin does not existing on the device"
Exit 1
}
Elseif ($Members.Name -notcontains $LAPSAdmin) {
Write-Output "User $LAPSAdmin created but not member of the group"
Exit 1
}
Else {
Write-Output "User $LAPSAdmin exists on the device and member of the group"
Exit 0
}
Stop-Transcript
Script de remédiation :
Start-Transcript -Path "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\LAPSLocalAdmin_Remediate.log" -Append
$LAPSAdmin = "Laps"
$Query = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount=True"
$Group = Get-WmiObject -Query "Select * From Win32_Group Where LocalAccount = TRUE And SID = 'S-1-5-32-544'"
$GroupName = $Group.Name
$Members=$group.GetRelated("win32_useraccount")
If ($Query.Name -notcontains $LAPSAdmin) {
Write-Output "User: $LAPSAdmin does not existing on the device, creating user"
try {
$password = "fO%B2vcr36+sj2v}<£]L"
Net User /Add $LAPSAdmin $password /Y
Write-Output "Added Local User $LAPSAdmin"
net localgroup $GroupName $LAPSAdmin /add
Write-Output "Added Local User $LAPSAdmin to Administrators"
Exit 0
}
catch {
Write-Error "Couldn't create user"
Exit 1
}
}
Elseif ($Members.Name -notcontains $LAPSAdmin) {
try {
Write-Output "Added Local User $LAPSAdmin"
net localgroup $GroupName $LAPSAdmin /add
Write-Output "Added Local User $LAPSAdmin to Administrators"
Exit 0
}
catch {
Write-Error "Couldn't add user in the group"
Exit 1
}
}
Else {
Write-Output "User $LAPSAdmin exists on the device"
Exit 0
}
Stop-Transcript
Un de mes clients m'a demandé de changer le port RDP par défaut (3389) par un port personnalisé afin de renforcer la sécurité, sur tous les appareils Windows qui sont gérés par Intune.
Ma proposition était de créer un script de remédiation et le pousser sur tous le parc Windows.
N.B : je vais utiliser le port 6612 comme exemple de port RDP personnalisé.
Script de détection :
# Get RDP information
$PortNumber = (Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
# Check Custom Port number
if ($PortNumber -eq 6612)
{
Write-host "Port Number is OK"
exit 0
}
else
{
Write-host "Port Number should be changed from $PortNumber to 6612"
exit 1
}
Script de remédiation :
# Declare custom RDP Port value
$portvalue = 6612
Try {
#Do the RDP port change
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -name "PortNumber" -Value $portvalue
New-NetFirewallRule -DisplayName 'RDPPORTLatest-TCP-In' -Profile 'Public' -Direction Inbound -Action Allow -Protocol TCP -LocalPort $portvalue
Write-Host "RDP port has changed to $portvalue"
}
Catch
{
# Output the Error and Log to a file
Write-host "Encountered Error:"$_.Exception.Message
}