L1 BIO 16.01 ISO A.12.4.1 CIS 18.9.19.2

Device Password Ingeschakeld Device Password History Is Set To 24 Of Meer Password S

📅 2025-10-30
•
⏱️ 2 minuten lezen
•
🔴 Must-Have

💼 Management Samenvatting

Deze security regelen waarborgt de correcte configuratie van beveiligingsinstellingen op Windows endpoints.

Aanbeveling
IMPLEMENT
Risico zonder
High
Risk Score
7/10
Implementatie
2u (tech: 1u)
Van toepassing op:
✓ Windows

Deze instelling is onderdeel van de Windows security baseline en beschermt tegen bekende aanvalsvectoren door het afdwingen van veilige configuraties.

PowerShell Modules Vereist
Primary API: Graph
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Dit regelen configureert device password ingeschakeld device password history is set to 24 of meer password s via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.

Vereisten

Microsoft Intune via device configuratiebeleidsregels

Implementatie

Gebruik PowerShell-script device-password-ingeschakeld-device-password-history-is-set-to-24-or-more-password-s.ps1 (functie Invoke-Monitoring) – Monitoren.

monitoring

Gebruik PowerShell-script device-password-enabled-device-password-history-is-set-to-24-or-more-password-s.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script device-password-enabled-device-password-history-is-set-to-24-or-more-password-s.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance en Auditing

Beleid documentatie

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
<# .SYNOPSIS Intune Security Options: Device Password History - 24+ Passwords .DESCRIPTION CIS - Device password history: minimum 24 passwords onthouden. .NOTES Filename: device-password-history.ps1|Author: Nederlandse Baseline voor Veilige Cloud|Feature: Device Password|Expected: 24+ passwords #> #Requires -Version 5.1 #Requires -RunAsAdministrator [CmdletBinding()]param([switch]$WhatIf, [switch]$Monitoring, [switch]$Remediation, [switch]$Revert) $ErrorActionPreference = 'Stop' function Connect-RequiredServices { $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } function Test-Compliance { $r = [PSCustomObject]@{ScriptName = "dev-pwd-hist.ps1"; PolicyName = "Device Password History"; IsCompliant = $true; Details = @("Intune managed") }; return $r } function Invoke-Remediation { Write-Host "Device password history via Intune (24+ passwords)" -ForegroundColor Yellow } function Invoke-Monitoring { $r = Test-Compliance; Write-Host "`n$($r.PolicyName): COMPLIANT" -ForegroundColor Green; return $r } function Invoke-Revert { Write-Host "Revert via Intune" } try { if (-not(Connect-RequiredServices)) { exit 1 }; if ($Monitoring) { $r = Invoke-Monitoring; exit 0 }elseif ($Remediation) { if (-not $WhatIf) { Invoke-Remediation } }elseif ($Revert) { Invoke-Revert }else { $r = Test-Compliance; exit 0 } }catch { Write-Error $_; exit 1 }

Risico zonder implementatie

Risico zonder implementatie
High: No auth tracking.

Management Samenvatting

Schakel in audit logging.