Support for import ADMX template into Intune

[harvester57]

Support for import ADMX template into Intune

[script-it-check-it-quick-rewrite-it]

After doing some research, I found the following:

When the ADMX policies are ingested, the registry keys to which each policy is written are checked so that known system registry keys, or registry keys that are used by existing inbox policies or system components, are not overwritten.

Currently, the ingested policies are not allowed to write to locations within the System, Software\Microsoft, and Software\Policies\Microsoft keys, except for the following locations:

• Software\Policies\Microsoft\Office\
• Software\Microsoft\Office\
• Software\Microsoft\Windows\CurrentVersion\Explorer\
• Software\Microsoft\Internet Explorer\
• software\policies\microsoft\shared tools\proofing tools\
• software\policies\microsoft\imejp\
• software\policies\microsoft\ime\shared\
• software\policies\microsoft\shared tools\graphics filters\
• software\policies\microsoft\windows\currentversion\explorer\
• software\policies\microsoft\softwareprotectionplatform\
• software\policies\microsoft\officesoftwareprotectionplatform\
• software\policies\microsoft\windows\windows search\preferences\
• software\policies\microsoft\exchange\
• software\microsoft\shared tools\proofing tools\
• software\microsoft\shared tools\graphics filters\
• software\microsoft\windows\windows search\preferences\
• software\microsoft\exchange\
• software\policies\microsoft\vba\security\
• software\microsoft\onedrive
• software\Microsoft\Edge
• Software\Microsoft\EdgeUpdate\

source: Microsoft

With the help from Camille Debay's Admix Validator Powershell script, only the following are able to be used via Intune:

• Number of PBKDF2 iterations for cached logons credentials hashing
• Additional registry fix for CVE-2015-6161
• Additional registry fix for CVE-2017-8529