Rules/INT-006.devices-encrypted.psd1
|
@{ Id = 'INT-006' Title = 'Every managed device reports storage encryption' Area = 'ManagedDevices' Severity = 'High' References = @( 'https://learn.microsoft.com/intune/intune-service/protect/encrypt-devices' ) Rationale = 'An unencrypted laptop is a data breach in a backpack - device loss turns into disclosure the moment the disk is readable.' Remediation = 'Enforce BitLocker/FileVault via compliance policy and configuration profile; remediate the flagged devices.' Test = { param($Snapshot) $summary = $Snapshot.ManagedDevices.summary $notEncrypted = [int]$summary.notEncryptedCount if ($notEncrypted -eq 0) { New-TLRuleResult -Status Pass -Evidence ("All {0} managed devices report encryption." -f $summary.total) } else { $examples = @($Snapshot.ManagedDevices.devices | Where-Object { -not $_.isEncrypted } | Select-Object -First 10 | ForEach-Object { "$($_.deviceName) ($($_.operatingSystem))" }) New-TLRuleResult -Status Fail -Evidence (@("{0} of {1} managed devices report no encryption." -f $notEncrypted, $summary.total) + $examples) } } } |