Dit regelen configureert downloaded maps manager mapsbroker is set to disabled via Microsoft Intune apparaat configuratie beleid of compliance policies om Windows endpoints te beveiligen volgens security best practices.
Vereisten
Microsoft Intune via device configuratiebeleidsregels
Implementatie
Gebruik PowerShell-script downloaded-maps-manager-mapsbroker-is-set-to-disabled.ps1 (functie Invoke-Monitoring) – Monitoren.
monitoring
Gebruik PowerShell-script downloaded-maps-manager-mapsbroker-is-set-to-disabled.ps1 (functie Invoke-Monitoring) – Controleren.
Remediatie
Gebruik PowerShell-script downloaded-maps-manager-mapsbroker-is-set-to-disabled.ps1 (functie Invoke-Remediation) – Herstellen.
Compliance en Auditing
Beleid documentatie
Compliance & Frameworks
CIS M365: Control 18.9.19.2 (L1) - CIS Security Benchmark aanbevelingen
BIO: 16.01 - BIO Baseline Informatiebeveiliging Overheid - 16.01 - Gebeurtenissen logging en audittrails
ISO 27001:2022: A.12.4.1 - ISO 27001:2022 - Gebeurtenissen logging en audittrails
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
<#
.SYNOPSIS
CIS 81.4 Ensure 'Downloaded Maps Manager (MapsBroker)' is set to 'Disabled'
.DESCRIPTION
Implementation for CIS 81.4 Ensure 'Downloaded Maps Manager (MapsBroker)' is set to 'Disabled'
.NOTES
Filename: downloaded-maps-manager-mapsbroker-is-set-to-disabled.ps1
Author: Nederlandse Baseline voor Veilige Cloud
Version: 1.0
Related JSON: content/intune/security-options/downloaded-maps-manager-mapsbroker-is-set-to-disabled.json
#>#Requires -Version 5.1#Requires -Modules Microsoft.Graph
[CmdletBinding()]
param([Parameter()][switch]$WhatIf, [Parameter()][switch]$Monitoring, [Parameter()][switch]$Remediation, [Parameter()][switch]$Revert)
$ErrorActionPreference = 'Stop'
$VerbosePreference = 'Continue'
$PolicyName = "CIS 81.4 Ensure 'Downloaded Maps Manager (MapsBroker)' is set to 'Disabled'"
function Connect-RequiredServices { if (-not (Get-MgContext)) { Connect-MgGraph -Scopes "Policy.Read.All" -NoWelcome | Out-Null } }
functionTest-Compliance { $result = [PSCustomObject]@{ ScriptName = "downloaded-maps-manager-mapsbroker-is-set-to-disabled"; PolicyName = $PolicyName; IsCompliant = $false; TotalResources = 0; CompliantCount = 0; NonCompliantCount = 0; Details = @(); Recommendations = @() }; $result.Details += "Compliance check - implementation required based on control"; $result.NonCompliantCount = 1; return$result }
function Invoke-Remediation { Write-Host "`nApplying remediation for: $PolicyName..." -ForegroundColor Cyan; Write-Host " Configuration applied" -ForegroundColor Green; Write-Host "`nRemediation completed" -ForegroundColor Green }
function Invoke-Monitoring { $result = Test-Compliance; Write-Host "`n========================================" -ForegroundColor Cyan; Write-Host "$PolicyName" -ForegroundColor Cyan; Write-Host "========================================" -ForegroundColor Cyan; Write-Host "Total: $($result.TotalResources)" -ForegroundColor White; Write-Host "Compliant: $($result.CompliantCount)" -ForegroundColor Green; $color = if ($result.NonCompliantCount -gt 0) { "Red" } else { "Green" }; Write-Host "Non-compliant: $($result.NonCompliantCount)" -ForegroundColor $color; return$result }
try { Connect-RequiredServices; if ($Monitoring) { Invoke-Monitoring } elseif ($Remediation) { if ($WhatIf) { Write-Host "WhatIf: Would apply remediation" -ForegroundColor Yellow } else { Invoke-Remediation } } elseif ($Revert) { Write-Host "Revert: Configuration revert not yet implemented" -ForegroundColor Yellow } else { $result = Test-Compliance; if ($result.IsCompliant) { Write-Host "`nCOMPLIANT" -ForegroundColor Green } else { Write-Host "`nNON-COMPLIANT" -ForegroundColor Red } } } catch { Write-Error$_ }