Rules/INT-007.supported-os-versions.psd1
|
@{ Id = 'INT-007' Title = 'No managed devices on unsupported OS versions' Area = 'ManagedDevices' Severity = 'Medium' References = @( 'https://learn.microsoft.com/lifecycle/products/windows-10-home-and-pro' ) Rationale = 'Windows 10 left support in October 2025 - devices on it receive no security updates while still holding corporate data and tokens.' Remediation = 'Upgrade or replace the flagged devices; add an OS minimum version to the compliance policy so unsupported devices lose access via Conditional Access.' Test = { param($Snapshot) $summary = $Snapshot.ManagedDevices.summary $unsupported = [int]$summary.unsupportedOsCount if ($unsupported -eq 0) { New-TLRuleResult -Status Pass -Evidence ("All {0} managed devices run supported OS versions." -f $summary.total) } else { $examples = @($Snapshot.ManagedDevices.devices | Where-Object { $_._tlUnsupportedOs } | Select-Object -First 10 | ForEach-Object { "$($_.deviceName) ($($_.operatingSystem) $($_.osVersion))" }) New-TLRuleResult -Status Fail -Evidence (@("{0} of {1} managed devices run an unsupported OS version." -f $unsupported, $summary.total) + $examples) } } } |