andrewamason/Intune
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Additional Script Updates

Browse Source
This commit is contained in:
Andrew Amason
2025-05-19 15:19:36 -04:00
parent ec2b22290a
commit 9c8438d7d1
136 changed files with 1595 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
intune/Externally Sourced Remediations/DeviceCompliance/Get-CredentialGuard/Detect_CredentialGuard.ps1 Normal file
View File

@@ -0,0 +1,12 @@
# Detection Script: Detect_CredentialGuard.ps1
# Check if Credential Guard is enabled
$credentialGuardStatus = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
if ($credentialGuardStatus.SecurityServicesConfigured -contains 1 -and $credentialGuardStatus.SecurityServicesRunning -contains 1) {
Write-Output "Credential Guard is enabled."
exit 0
} else {
Write-Output "Credential Guard is not enabled."
exit 1
}

11
intune/Externally Sourced Remediations/DeviceCompliance/Get-CredentialGuard/Remediate_CredentialGuard.ps1 Normal file
View File

@@ -0,0 +1,11 @@
# Remediation Script: Remediate_CredentialGuard.ps1
# Enable Credential Guard
$regKey = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard"
Set-ItemProperty -Path $regKey -Name "EnableVirtualizationBasedSecurity" -Value 1
Set-ItemProperty -Path $regKey -Name "RequirePlatformSecurityFeatures" -Value 1
$regKey = "HKLM:\SYSTEM\CurrentControlSet\Control\LSA"
Set-ItemProperty -Path $regKey -Name "LsaCfgFlags" -Value 1
Write-Output "Credential Guard has been enabled."