💼 Management Samenvatting
Het configureren van Outlook als standaard e-mail programma zorgt voor consistente security policies, centraal control van e-mail security settings, en voorkomt gebruik van onbeheerde e-mail clients met zwakkere beveiliging.
Aanbeveling
CONSIDER
Risico zonder
Low
Risk Score
2/10
Implementatie
2u (tech: 1u)
Van toepassing op:
✓ Microsoft Office 365 ProPlus
✓ Microsoft Outlook 2016
✓ Microsoft Outlook 2019
✓ Microsoft Outlook 2021
✓ Microsoft 365 Apps
✓ Microsoft Outlook 2016
✓ Microsoft Outlook 2019
✓ Microsoft Outlook 2021
✓ Microsoft 365 Apps
Wanneer Outlook niet de default e-mail client is: **Security Policy Bypass**: Alternative e-mail clients (Windows Mail, Thunderbird, web-based) hebben mogelijk niet dezelfde security controls (attachment blocking, safe links, anti-phishing). **Inconsistent gebruikerservaring**: Users verwachten Outlook features (calendar integration, Teams integration) maar krijgen basic e-mail client. **Management Overhead**: IT moet multiple e-mail clients beheren en secure. **Data Leakage Risk**: Alternative clients synchroniseren mogelijk naar onbeheerde locations. Door Outlook als default te configureren, ensures consistent security posture en IT-managed e-mail environment.
PowerShell Modules Vereist
Primary API: Registry / Group Policy
Connection:
Required Modules: Windows PowerShell 5.1 of hoger
Connection:
Lokale registry toegang of Group Policy ManagementRequired Modules: Windows PowerShell 5.1 of hoger
Implementatie
Deze configuratie set Outlook als default MAPI/mailto handler en default e-mail programma in Windows. Users die op mailto: links klikken of 'Send Email' in applicaties gebruiken, openen automatisch Outlook (niet alternative clients). Configuration via Windows default programs registry keys.
Vereisten
- Microsoft Office 2016+ installed
- Windows 10/11
- Administrator-rechten voor default programs configuration
- GPO of Intune voor centralized deployment
Implementatie
**Group Policy**: Use Office GPO templates om Outlook as default te configureren. **Intune**: configureer default apps policy met Outlook als mailto handler. **Registry**: HKCU\Software\Clients\Mail en HKEY_CLASSES_ROOT\mailto keys.
Test: Klik mailto: link → Outlook moet openen (niet other client).
monitoring
Gebruik PowerShell-script make-outlook-default-program.ps1 (functie Invoke-Monitoring) – Controleren.
monitor compliance: percentage machines met Outlook as default, helpdesk tickets voor alternative client usage.
Compliance
- BIO U.12.2 - Managed security controls
- ISO 27001 A.12.2 - bescherming from malware
- CIS Controls - Managed software inventory
Remediatie
Gebruik PowerShell-script make-outlook-default-program.ps1 (functie Invoke-Remediation) – Herstellen.
Compliance & Frameworks
- CIS M365: Control 2.3 (L1) - Managed software
- BIO: U.12.2.1 - Managed security controls
- ISO 27001:2022: A.12.2.1 - Malware bescherming
Automation
Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).
PowerShell
# Control: O365-OU-000001 - make outlook default program
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000001: make outlook default program" -ForegroundColor Green
try {
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
}
catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000001: make outlook default program" -ForegroundColor Yellow
try {
if (-not (Test-Path $RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "✓ Registry value set successfully: $valueName = $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
$complianceResult = Invoke-Monitoring
return $complianceResult
}
catch {
Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Revert {
Write-Host "Reverting O365-OU-000001: make outlook default program
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return $true
}
$valueName = "makeoutlookdefaultprogram"
if (Test-Path $RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return $true
}
catch {
Write-Host " Error during revert: # Control: O365-OU-000001 - make outlook default program
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000001: make outlook default program" -ForegroundColor Green
try {
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
} catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000001: make outlook default program" -ForegroundColor Yellow
try {
if (-not (Test-Path $RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "✓ Registry value set successfully: $valueName = $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
$complianceResult = Invoke-Monitoring
return $complianceResult
} catch {
Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: # Control: O365-OU-000001 - make outlook default program
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000001: make outlook default program" -ForegroundColor Green
try {
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
}
catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000001: make outlook default program" -ForegroundColor Yellow
try {
if (-not (Test-Path $RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "✓ Registry value set successfully: $valueName = $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
$complianceResult = Invoke-Monitoring
return $complianceResult
}
catch {
Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Revert {
Write-Host "Reverting O365-OU-000001: make outlook default program
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return $true
}
$valueName = "makeoutlookdefaultprogram"
if (Test-Path $RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return $true
}
catch {
Write-Host " Error during revert: # Control: O365-OU-000001 - make outlook default program
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000001: make outlook default program" -ForegroundColor Green
try {
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
} catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000001: make outlook default program" -ForegroundColor Yellow
try {
if (-not (Test-Path $RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "✓ Registry value set successfully: $valueName = $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
$complianceResult = Invoke-Monitoring
return $complianceResult
} catch {
Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
} else {
Write-Host "Usage: .\make-outlook-default-program.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
}
" -ForegroundColor Red
return $false
}
}
# Main execution
try {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: .\make-outlook-default-program.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
}
" -ForegroundColor Red
exit 1
}
" -ForegroundColor Red
return $false
}
}
# Main execution
try {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Revert) {
$result = Invoke-Revert
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow
}
}
catch {
Write-Host "Script execution error: # Control: O365-OU-000001 - make outlook default program
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000001: make outlook default program" -ForegroundColor Green
try {
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
} else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
} catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000001: make outlook default program" -ForegroundColor Yellow
try {
if (-not (Test-Path $RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "✓ Registry value set successfully: $valueName = $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
$complianceResult = Invoke-Monitoring
return $complianceResult
} catch {
Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Revert {
Write-Host "Reverting O365-OU-000001: make outlook default program
" -ForegroundColor Yellow
try {
if ($WhatIf) {
Write-Host " [WhatIf] Would remove registry value" -ForegroundColor Cyan
return $true
}
$valueName = "makeoutlookdefaultprogram"
if (Test-Path $RegistryPath) {
Remove-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
Write-Host " Removed registry value: $valueName" -ForegroundColor Green
}
return $true
} catch {
Write-Host " Error during revert: # Control: O365-OU-000001 - make outlook default program
#Requires -Version 5.1
# DISA STIG Microsoft Office 365 ProPlus v3r3
param(
[string]$RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\OUTLOOK\Security",
[switch]$Monitoring,
[switch]$Remediation,
[switch]$Revert,
[switch]$WhatIf
)
function Invoke-Monitoring {
Write-Host "Monitoring O365-OU-000001: make outlook default program" -ForegroundColor Green
try {
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
if (-not (Test-Path $RegistryPath)) {
Write-Host "✗ Registry path does not exist: $RegistryPath" -ForegroundColor Red
return $false
}
$currentValue = Get-ItemProperty -Path $RegistryPath -Name $valueName -ErrorAction SilentlyContinue
if ($currentValue -and $currentValue.$valueName -eq $expectedValue) {
Write-Host "✓ Control compliant: $valueName = $expectedValue" -ForegroundColor Green
return $true
}
else {
$actualValue = if ($currentValue) { $currentValue.$valueName } else { "Not Set" }
Write-Host "✗ Control non-compliant: $valueName = $actualValue (Expected: $expectedValue)" -ForegroundColor Red
return $false
}
}
catch {
Write-Host "✗ Error checking registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
function Invoke-Remediation {
Write-Host "Remediating O365-OU-000001: make outlook default program" -ForegroundColor Yellow
try {
if (-not (Test-Path $RegistryPath)) {
Write-Host "Creating registry path: $RegistryPath" -ForegroundColor Yellow
New-Item -Path $RegistryPath -Force | Out-Null
}
$valueName = "makeoutlookdefaultprogram"
$expectedValue = 1
Set-ItemProperty -Path $RegistryPath -Name $valueName -Value $expectedValue -Type DWord -Force
Write-Host "✓ Registry value set successfully: $valueName = $expectedValue" -ForegroundColor Green
Start-Sleep -Seconds 1
$complianceResult = Invoke-Monitoring
return $complianceResult
}
catch {
Write-Host "✗ Error configuring registry setting: $($_.Exception.Message)" -ForegroundColor Red
return $false
}
}
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
}
elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
}
else {
Write-Host "Usage: .\make-outlook-default-program.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
}
" -ForegroundColor Red
return $false
}
}
# Main execution
try {
if ($Monitoring) {
$result = Invoke-Monitoring
exit $(if ($result) { 0 } else { 1 })
} elseif ($Remediation) {
$result = Invoke-Remediation
exit $(if ($result) { 0 } else { 1 })
} else {
Write-Host "Usage: .\make-outlook-default-program.ps1 [-Monitoring] [-Remediation]" -ForegroundColor Yellow
Write-Host " -Monitoring: Check current compliance status" -ForegroundColor White
Write-Host " -Remediation: Apply recommended configuration" -ForegroundColor White
}
" -ForegroundColor Red
exit 1
}
Risico zonder implementatie
Risico zonder implementatie
Low: laag risico: alternative clients kunnen security controls bypassen, maar typically beperkte impact in managed environments.
Management Samenvatting
configureer Outlook als default e-mail client voor consistent security. Implementatie: 2 uur.
- Implementatietijd: 2 uur
- FTE required: 0.02 FTE