Restreindre la communication Internet
Vérifié avec Windows 11 25H2 — mis à jour le 30 juillet 2026
Pris en charge sur : Au minimum Windows XP Professionnel avec SP2
Chemin dans la console GPO
Configuration ordinateur\Modèles d'administration\Système\Gestion de la communication Internet Description
Ce paramètre de stratégie indique si Windows peut accéder à Internet pour accomplir des tâches qui nécessitent des ressources Internet. Si vous activez ce paramètre de stratégie, tous les paramètres de stratégie affichés dans la section « Paramètres de communication Internet » sont définis de sorte que leurs fonctionnalités correspondantes aient accès à Internet. Si vous désactivez ce paramètre de stratégie, tous les paramètres de stratégie affichés dans la section « Paramètres de communication Internet » sont définis de sorte que leurs fonctionnalités correspondantes aient accès à Internet. Si vous ne configurez pas ce paramètre de stratégie, aucun des paramètres de stratégie affichés dans la section « Paramètres de communication Internet » n’est configuré.
Registre
HKLM
Software\Policies\Microsoft\InternetManagement Nom de valeur : RestrictCommunication
Activé : RestrictCommunication = 1
Désactivé : RestrictCommunication = 0
Cette stratégie définit plusieurs valeurs de registre :
NoPublishingWizard Explorer Activé :
NoPublishingWizard = 1 Désactivé :
NoPublishingWizard = 0 NoWebServices Explorer Activé :
NoWebServices = 1 Désactivé :
NoWebServices = 0 NoGenTicket Software Protection Platform Activé :
NoGenTicket = 1 Désactivé :
NoGenTicket = 0 AllowWindowsEntitlementReactivation Software Protection Platform Activé :
AllowWindowsEntitlementReactivation = 1 Désactivé :
AllowWindowsEntitlementReactivation = 0 NoOnlinePrintsWizard Explorer Activé :
NoOnlinePrintsWizard = 1 Désactivé :
NoOnlinePrintsWizard = 0 CEIP Client Activé :
CEIP = 2 Désactivé :
CEIP = 1 Headlines HelpSvc Activé :
Headlines = 0 Désactivé :
Headlines = 1 MicrosoftKBSearch HelpSvc Activé :
MicrosoftKBSearch = 0 Désactivé :
MicrosoftKBSearch = 1 DoReport ErrorReporting Activé :
DoReport = 0 Désactivé :
DoReport = 1 Disabled Windows Error Reporting Activé :
Disabled = 1 Désactivé :
Disabled = 0 NoInternetOpenWith Explorer Activé :
NoInternetOpenWith = 1 Désactivé :
NoInternetOpenWith = 0 ExitOnMSICW Internet Connection Wizard Activé :
ExitOnMSICW = 1 Désactivé :
ExitOnMSICW = 0 MicrosoftEventVwrDisableLinks EventViewer Activé :
MicrosoftEventVwrDisableLinks = 1 Désactivé :
MicrosoftEventVwrDisableLinks = 0 DisableRootAutoUpdate AuthRoot Activé :
DisableRootAutoUpdate = 1 Désactivé :
DisableRootAutoUpdate = 0 NoRegistration Registration Wizard Control Activé :
NoRegistration = 1 Désactivé :
NoRegistration = 0 DisableContentFileUpdates SearchCompanion Activé :
DisableContentFileUpdates = 1 Désactivé :
DisableContentFileUpdates = 0 DisableHTTPPrinting Printers Activé :
DisableHTTPPrinting = 1 Désactivé :
DisableHTTPPrinting = 0 DisableWebPnPDownload Printers Activé :
DisableWebPnPDownload = 1 Désactivé :
DisableWebPnPDownload = 0 DontSearchWindowsUpdate DriverSearching Activé :
DontSearchWindowsUpdate = 1 Désactivé :
DontSearchWindowsUpdate = 0 DisableWindowsUpdateAccess WindowsUpdate Activé :
DisableWindowsUpdateAccess = 1 Désactivé :
DisableWindowsUpdateAccess = 0 PreventHandwritingErrorReports HandwritingErrorReports Activé :
PreventHandwritingErrorReports = 1 Désactivé :
PreventHandwritingErrorReports = 0 PreventHandwritingDataSharing TabletPC Activé :
PreventHandwritingDataSharing = 1 Désactivé :
PreventHandwritingDataSharing = 0 WebHelp WindowsMovieMaker Activé :
WebHelp = 1 Désactivé :
WebHelp = 0 CodecDownload WindowsMovieMaker Activé :
CodecDownload = 1 Désactivé :
CodecDownload = 0 WebPublish WindowsMovieMaker Activé :
WebPublish = 1 Désactivé :
WebPublish = 0 CEIPEnable Windows Activé :
CEIPEnable = 0 Désactivé :
CEIPEnable = 1 NoActiveProbe NetworkConnectivityStatusIndicator Activé :
NoActiveProbe = 1 Désactivé :
NoActiveProbe = 0 NoAutoUpdate AU Activé :
NoAutoUpdate = (non défini) Désactivé :
NoAutoUpdate = 0 MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_ICM/InternetManagement_RestrictCommunication_2 Documentation Microsoft Learn Données de correspondance : Microsoft Learn (CC BY 4.0)
Générateur d'exports
BETAConfigurez l'état, la portée et les options, puis générez les sorties .reg, PowerShell, Intune et SCCM — ou ajoutez le paramètre à une collection multi-paramètres.
Ces exports écrivent le registre — ce n'est pas une GPO managée. ⓘ
Fichier .reg
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Restreindre la communication Internet
; State: Enabled
; Supported on: Au minimum Windows XP Professionnel avec SP2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\InternetManagement]
"RestrictCommunication"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoPublishingWizard"=dword:00000001
"NoWebServices"=dword:00000001
"NoOnlinePrintsWizard"=dword:00000001
"NoInternetOpenWith"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform]
"NoGenTicket"=dword:00000001
"AllowWindowsEntitlementReactivation"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Messenger\Client]
"CEIP"=dword:00000002
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PCHealth\HelpSvc]
"Headlines"=dword:00000000
"MicrosoftKBSearch"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PCHealth\ErrorReporting]
"DoReport"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting]
"Disabled"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Internet Connection Wizard]
"ExitOnMSICW"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EventViewer]
"MicrosoftEventVwrDisableLinks"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot]
"DisableRootAutoUpdate"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Registration Wizard Control]
"NoRegistration"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SearchCompanion]
"DisableContentFileUpdates"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers]
"DisableHTTPPrinting"=dword:00000001
"DisableWebPnPDownload"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching]
"DontSearchWindowsUpdate"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate]
"DisableWindowsUpdateAccess"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\HandwritingErrorReports]
"PreventHandwritingErrorReports"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\TabletPC]
"PreventHandwritingDataSharing"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMovieMaker]
"WebHelp"=dword:00000001
"CodecDownload"=dword:00000001
"WebPublish"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SQMClient\Windows]
"CEIPEnable"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator]
"NoActiveProbe"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU]
; "NoAutoUpdate" = (not defined)Autres formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Restreindre la communication Internet
# State: Enabled
# Supported on: Au minimum Windows XP Professionnel avec SP2
$path = 'HKLM:\Software\Policies\Microsoft\InternetManagement'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RestrictCommunication' -Value 1 -Type DWord
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoPublishingWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWebServices' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoOnlinePrintsWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoInternetOpenWith' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoGenTicket' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowWindowsEntitlementReactivation' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Messenger\Client'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIP' -Value 2 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Headlines' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'MicrosoftKBSearch' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoReport' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Disabled' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExitOnMSICW' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\EventViewer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'MicrosoftEventVwrDisableLinks' -Value 1 -Type DWord
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoRegistration' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SearchCompanion'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableContentFileUpdates' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableHTTPPrinting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DisableWebPnPDownload' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DontSearchWindowsUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingErrorReports' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingDataSharing' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WebHelp' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'CodecDownload' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'WebPublish' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIPEnable' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoActiveProbe' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
# NoAutoUpdate = (not defined)Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_ICM/InternetManagement_RestrictCommunication_2
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Restreindre la communication Internet
# State: Enabled
# Supported on: Au minimum Windows XP Professionnel avec SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate: NoAutoUpdate= is not representable as a registry value.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\InternetManagement' -Name 'RestrictCommunication' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoPublishingWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoWebServices' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'NoGenTicket' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'AllowWindowsEntitlementReactivation' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoOnlinePrintsWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Messenger\Client' -Name 'CEIP' -Expected 2 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'Headlines' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'MicrosoftKBSearch' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting' -Name 'DoReport' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting' -Name 'Disabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoInternetOpenWith' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard' -Name 'ExitOnMSICW' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\EventViewer' -Name 'MicrosoftEventVwrDisableLinks' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot' -Name 'DisableRootAutoUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control' -Name 'NoRegistration' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SearchCompanion' -Name 'DisableContentFileUpdates' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableHTTPPrinting' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableWebPnPDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching' -Name 'DontSearchWindowsUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DisableWindowsUpdateAccess' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports' -Name 'PreventHandwritingErrorReports' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC' -Name 'PreventHandwritingDataSharing' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebHelp' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'CodecDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebPublish' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows' -Name 'CEIPEnable' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator' -Name 'NoActiveProbe' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restreindre la communication Internet
# State: Enabled
# Supported on: Au minimum Windows XP Professionnel avec SP2
$path = 'HKLM:\Software\Policies\Microsoft\InternetManagement'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RestrictCommunication' -Value 1 -Type DWord
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoPublishingWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWebServices' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoOnlinePrintsWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoInternetOpenWith' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoGenTicket' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowWindowsEntitlementReactivation' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Messenger\Client'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIP' -Value 2 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Headlines' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'MicrosoftKBSearch' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoReport' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Disabled' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExitOnMSICW' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\EventViewer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'MicrosoftEventVwrDisableLinks' -Value 1 -Type DWord
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoRegistration' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SearchCompanion'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableContentFileUpdates' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableHTTPPrinting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DisableWebPnPDownload' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DontSearchWindowsUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingErrorReports' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingDataSharing' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WebHelp' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'CodecDownload' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'WebPublish' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIPEnable' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoActiveProbe' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
# NoAutoUpdate = (not defined)Scripts SCCM
# Exported from gporais.com
# Policy: Restreindre la communication Internet
# State: Enabled
# Supported on: Au minimum Windows XP Professionnel avec SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Restreindre la communication Internet
# State: Enabled
# Supported on: Au minimum Windows XP Professionnel avec SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate: NoAutoUpdate= is not representable as a registry value.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\InternetManagement' -Name 'RestrictCommunication' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoPublishingWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoWebServices' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'NoGenTicket' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform' -Name 'AllowWindowsEntitlementReactivation' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoOnlinePrintsWizard' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Messenger\Client' -Name 'CEIP' -Expected 2 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'Headlines' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc' -Name 'MicrosoftKBSearch' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting' -Name 'DoReport' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting' -Name 'Disabled' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name 'NoInternetOpenWith' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard' -Name 'ExitOnMSICW' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\EventViewer' -Name 'MicrosoftEventVwrDisableLinks' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot' -Name 'DisableRootAutoUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control' -Name 'NoRegistration' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SearchCompanion' -Name 'DisableContentFileUpdates' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableHTTPPrinting' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers' -Name 'DisableWebPnPDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching' -Name 'DontSearchWindowsUpdate' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate' -Name 'DisableWindowsUpdateAccess' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports' -Name 'PreventHandwritingErrorReports' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC' -Name 'PreventHandwritingDataSharing' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebHelp' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'CodecDownload' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker' -Name 'WebPublish' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows' -Name 'CEIPEnable' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator' -Name 'NoActiveProbe' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restreindre la communication Internet
# State: Enabled
# Supported on: Au minimum Windows XP Professionnel avec SP2
$path = 'HKLM:\Software\Policies\Microsoft\InternetManagement'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'RestrictCommunication' -Value 1 -Type DWord
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoPublishingWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoWebServices' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoOnlinePrintsWizard' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'NoInternetOpenWith' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoGenTicket' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'AllowWindowsEntitlementReactivation' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Messenger\Client'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIP' -Value 2 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\HelpSvc'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Headlines' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'MicrosoftKBSearch' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\PCHealth\ErrorReporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DoReport' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Windows Error Reporting'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Disabled' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Internet Connection Wizard'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ExitOnMSICW' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\EventViewer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'MicrosoftEventVwrDisableLinks' -Value 1 -Type DWord
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Registration Wizard Control'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoRegistration' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SearchCompanion'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableContentFileUpdates' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\Printers'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableHTTPPrinting' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'DisableWebPnPDownload' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\DriverSearching'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DontSearchWindowsUpdate' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableWindowsUpdateAccess' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\HandwritingErrorReports'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingErrorReports' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\TabletPC'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventHandwritingDataSharing' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\WindowsMovieMaker'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'WebHelp' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'CodecDownload' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'WebPublish' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\SQMClient\Windows'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CEIPEnable' -Value 0 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'NoActiveProbe' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
# NoAutoUpdate = (not defined)Vous construisez une collection multi-paramètres ? Ajoutez ce paramètre et générez des exports combinés (.reg, PowerShell, GPO).