Microsoft365DSC

1.24.424.1

Examples/Resources/IntuneExploitProtectionPolicyWindows10SettingCatalog/1-Create.ps1

                                <#

This example is used to test new resources and showcase the usage of new resources being worked on.

It is not meant to use as a production baseline.

#>

Configuration Example

{

    param(

        [Parameter(Mandatory = $true)]

        [PSCredential]

        $Credscredential

    )

    Import-DscResource -ModuleName Microsoft365DSC

    node localhost

    {

        IntuneExploitProtectionPolicyWindows10SettingCatalog 'myWindows10ExploitProtectionPolicy'

        {

            DisplayName                       = 'exploit Protection policy with assignments'

            Assignments                       = @(

                MSFT_DeviceManagementConfigurationPolicyAssignments {

                    deviceAndAppManagementAssignmentFilterType = 'none'

                    dataType                                   = '#microsoft.graph.exclusionGroupAssignmentTarget'

                    groupId                                    = 'e8cbd84d-be6a-4b72-87f0-0e677541fda0'

                })

            Description                       = ''

            disallowexploitprotectionoverride = '1'

            exploitprotectionsettings         = "<?xml version=`"1.0`" encoding=`"UTF-8`"?>

<MitigationPolicy>

  <AppConfig Executable=`"AcroRd32.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"AcroRd32Info.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"clview.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"cnfnot32.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"excel.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"excelcnv.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"ExtExport.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"graph.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"ie4uinit.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"ieinstal.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"ielowutil.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"ieUnatt.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"iexplore.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"lync.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msaccess.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"mscorsvw.exe`">

    <ExtensionPoints DisableExtensionPoints=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"msfeedssync.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"mshta.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msoadfsb.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msoasb.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msohtmed.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msosrec.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msoxmled.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"mspub.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"msqry32.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"MsSense.exe`">

    <StrictHandle Enable=`"true`" />

    <SEHOP Enable=`"true`" TelemetryOnly=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"ngen.exe`">

    <ExtensionPoints DisableExtensionPoints=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"ngentask.exe`">

    <ExtensionPoints DisableExtensionPoints=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"onenote.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"onenotem.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"orgchart.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"outlook.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"powerpnt.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"PresentationHost.exe`">

    <DEP Enable=`"true`" EmulateAtlThunks=`"false`" />

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" BottomUp=`"true`" HighEntropy=`"true`" />

    <SEHOP Enable=`"true`" TelemetryOnly=`"false`" />

    <Heap TerminateOnError=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"PrintDialog.exe`">

    <ExtensionPoints DisableExtensionPoints=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"RdrCEF.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"RdrServicesUpdater.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"runtimebroker.exe`">

    <ExtensionPoints DisableExtensionPoints=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"scanost.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"scanpst.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"sdxhelper.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"selfcert.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"setlang.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"SystemSettings.exe`">

    <ExtensionPoints DisableExtensionPoints=`"true`" />

  </AppConfig>

  <AppConfig Executable=`"winword.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

  <AppConfig Executable=`"wordconv.exe`">

    <ASLR ForceRelocateImages=`"true`" RequireInfo=`"false`" />

  </AppConfig>

</MitigationPolicy>"

            Ensure                            = 'Present'

            Credential                        = $Credscredential

        }

    }

}