IntuneExploitProtectionPolicyWindows10SettingCatalog¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| Identity | Write | String | Identity of the endpoint protection policy. | |
| DisplayName | Key | String | Display name of the endpoint protection policy. | |
| Description | Write | String | Description of the endpoint protection. | |
| ExploitProtectionSettings | Write | String | Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. | |
| DisallowExploitProtectionOverride | Write | String | Prevent users from making changes to the exploit protection settings area in the Windows Defender Security Center.values 0:disable, 1:enable | 0, 1 |
| Assignments | Write | MSFT_DeviceManagementConfigurationPolicyAssignments[] | Assignments of the endpoint protection. | |
| Ensure | Write | String | Present ensures the policy exists, absent ensures it is removed | Present, Absent |
| Credential | Write | PSCredential | Credentials of the Intune Admin | |
| ApplicationId | Write | String | Id of the Azure Active Directory application to authenticate with. | |
| TenantId | Write | String | Name of the Azure Active Directory tenant used for authentication. Format contoso.onmicrosoft.com | |
| ApplicationSecret | Write | PSCredential | Secret of the Azure Active Directory tenant used for authentication. | |
| CertificateThumbprint | Write | String | Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication. | |
| ManagedIdentity | Write | Boolean | Managed ID being used for authentication. | |
| AccessTokens | Write | StringArray[] | Access token used for authentication. |
MSFT_DeviceManagementConfigurationPolicyAssignments¶
Parameters¶
| Parameter | Attribute | DataType | Description | Allowed Values |
|---|---|---|---|---|
| dataType | Write | String | The type of the target assignment. | #microsoft.graph.groupAssignmentTarget, #microsoft.graph.allLicensedUsersAssignmentTarget, #microsoft.graph.allDevicesAssignmentTarget, #microsoft.graph.exclusionGroupAssignmentTarget, #microsoft.graph.configurationManagerCollectionAssignmentTarget |
| deviceAndAppManagementAssignmentFilterType | Write | String | The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude. | none, include, exclude |
| deviceAndAppManagementAssignmentFilterId | Write | String | The Id of the filter for the target assignment. | |
| groupId | Write | String | The group Id that is the target of the assignment. | |
| groupDisplayName | Write | String | The group Display Name that is the target of the assignment. | |
| collectionId | Write | String | The collection Id that is the target of the assignment.(ConfigMgr) |
Description¶
This resource configures an Intune Endpoint Protection Exploit Protection policy for a Windows 10 Device. Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. The configuration is represented by an XML. For more information Exploit Protection, see - Enable Exploit Protection on Devices and Import: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-exploit-protection, - Export, and deploy Exploit Protection configurations: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/import-export-exploit-protection-emet-xml
Permissions¶
Microsoft Graph¶
To authenticate with the Microsoft Graph API, this resource required the following permissions:
Delegated permissions¶
-
Read
- Group.Read.All, DeviceManagementConfiguration.Read.All
-
Update
- Group.Read.All, DeviceManagementConfiguration.ReadWrite.All
Application permissions¶
-
Read
- Group.Read.All, DeviceManagementConfiguration.Read.All
-
Update
- Group.Read.All, DeviceManagementConfiguration.ReadWrite.All
Examples¶
Example 1¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
node localhost
{
IntuneExploitProtectionPolicyWindows10SettingCatalog 'myWindows10ExploitProtectionPolicy'
{
DisplayName = 'exploit Protection policy with assignments'
Assignments = @(
MSFT_DeviceManagementConfigurationPolicyAssignments {
deviceAndAppManagementAssignmentFilterType = 'none'
dataType = '#microsoft.graph.exclusionGroupAssignmentTarget'
groupId = 'e8cbd84d-be6a-4b72-87f0-0e677541fda0'
})
Description = ''
disallowexploitprotectionoverride = '1'
exploitprotectionsettings = "<?xml version=`"1.0`" encoding=`"UTF-8`"?>
<MitigationPolicy>
<AppConfig Executable=`"AcroRd32.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"AcroRd32Info.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"clview.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"cnfnot32.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"excel.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"excelcnv.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ExtExport.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"graph.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ie4uinit.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ieinstal.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ielowutil.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ieUnatt.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"iexplore.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"lync.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msaccess.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"mscorsvw.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"msfeedssync.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"mshta.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msoadfsb.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msoasb.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msohtmed.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msosrec.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msoxmled.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"mspub.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msqry32.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"MsSense.exe`">
<StrictHandle Enable=`"true`" />
<SEHOP Enable=`"true`" TelemetryOnly=`"false`" />
</AppConfig>
<AppConfig Executable=`"ngen.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"ngentask.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"onenote.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"onenotem.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"orgchart.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"outlook.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"powerpnt.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"PresentationHost.exe`">
<DEP Enable=`"true`" EmulateAtlThunks=`"false`" />
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" BottomUp=`"true`" HighEntropy=`"true`" />
<SEHOP Enable=`"true`" TelemetryOnly=`"false`" />
<Heap TerminateOnError=`"true`" />
</AppConfig>
<AppConfig Executable=`"PrintDialog.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"RdrCEF.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"RdrServicesUpdater.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"runtimebroker.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"scanost.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"scanpst.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"sdxhelper.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"selfcert.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"setlang.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"SystemSettings.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"winword.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"wordconv.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
</MitigationPolicy>"
Ensure = 'Present'
ApplicationId = $ApplicationId;
TenantId = $TenantId;
CertificateThumbprint = $CertificateThumbprint;
}
}
}
Example 2¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
node localhost
{
IntuneExploitProtectionPolicyWindows10SettingCatalog 'myWindows10ExploitProtectionPolicy'
{
DisplayName = 'exploit Protection policy with assignments'
Assignments = @(
MSFT_DeviceManagementConfigurationPolicyAssignments {
deviceAndAppManagementAssignmentFilterType = 'none'
dataType = '#microsoft.graph.exclusionGroupAssignmentTarget'
groupId = 'e8cbd84d-be6a-4b72-87f0-0e677541fda0'
})
Description = ''
disallowexploitprotectionoverride = '1'
exploitprotectionsettings = "<?xml version=`"1.0`" encoding=`"UTF-8`"?>
<MitigationPolicy>
<AppConfig Executable=`"AcroRd3Updated.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"AcroRd32Info.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"clview.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"cnfnot32.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"excel.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"excelcnv.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ExtExport.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"graph.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ie4uinit.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ieinstal.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ielowutil.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"ieUnatt.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"iexplore.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"lync.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msaccess.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"mscorsvw.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"msfeedssync.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"mshta.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msoadfsb.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msoasb.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msohtmed.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msosrec.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msoxmled.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"mspub.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"msqry32.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"MsSense.exe`">
<StrictHandle Enable=`"true`" />
<SEHOP Enable=`"true`" TelemetryOnly=`"false`" />
</AppConfig>
<AppConfig Executable=`"ngen.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"ngentask.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"onenote.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"onenotem.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"orgchart.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"outlook.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"powerpnt.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"PresentationHost.exe`">
<DEP Enable=`"true`" EmulateAtlThunks=`"false`" />
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" BottomUp=`"true`" HighEntropy=`"true`" />
<SEHOP Enable=`"true`" TelemetryOnly=`"false`" />
<Heap TerminateOnError=`"true`" />
</AppConfig>
<AppConfig Executable=`"PrintDialog.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"RdrCEF.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"RdrServicesUpdater.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"runtimebroker.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"scanost.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"scanpst.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"sdxhelper.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"selfcert.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"setlang.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"SystemSettings.exe`">
<ExtensionPoints DisableExtensionPoints=`"true`" />
</AppConfig>
<AppConfig Executable=`"winword.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
<AppConfig Executable=`"wordconv.exe`">
<ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />
</AppConfig>
</MitigationPolicy>" # Updated Property
Ensure = 'Present'
ApplicationId = $ApplicationId;
TenantId = $TenantId;
CertificateThumbprint = $CertificateThumbprint;
}
}
}
Example 3¶
This example is used to test new resources and showcase the usage of new resources being worked on. It is not meant to use as a production baseline.
Configuration Example
{
param(
[Parameter()]
[System.String]
$ApplicationId,
[Parameter()]
[System.String]
$TenantId,
[Parameter()]
[System.String]
$CertificateThumbprint
)
Import-DscResource -ModuleName Microsoft365DSC
node localhost
{
IntuneExploitProtectionPolicyWindows10SettingCatalog 'myWindows10ExploitProtectionPolicy'
{
DisplayName = 'exploit Protection policy with assignments'
Ensure = 'Absent'
ApplicationId = $ApplicationId;
TenantId = $TenantId;
CertificateThumbprint = $CertificateThumbprint;
}
}
}