Fix ActiveComputerName reg key permissions
🪟PowerShell🍻Script Share
Hopefully you don't hit this one - but if you're experiencing computers which cannot sign into M365 apps or M365 in the browser, if you have computers where the start menu won't open and the store crashes you may be experiencing this bug related to, it appears, a recent defender update:
Condition Script/Detection:
Setup your condition such that you look for the output "Required permissions missing"
Remediation script attached:
Condition Script/Detection:
Setup your condition such that you look for the output "Required permissions missing"
$RegistryPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\'
$Principal = 'APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES'
$Permission = [System.Security.AccessControl.RegistryRights]::ReadKey
# Check if the registry key exists.
if (Test-Path -Path $RegistryPath) {
# Get the current ACL for the registry key.
$ACL = Get-Acl -Path $RegistryPath
# Check if the group already has the specified permission.
$HasRequiredPermission = $false
foreach ($AccessRule in $ACL.Access) {
if ($AccessRule.IdentityReference -eq $Principal -and $AccessRule.RegistryRights -band $Permission) {
$HasRequiredPermission = $true
break
}
}
if (-not $HasRequiredPermission) {
Write-Host ('Required permissions missing for {0} on {1}.' -f $GroupName, $RegistryPath)
Write-Host ('Please run Repair-ActiveComputerNameRegistryKey to create the registry key and set the permissions.')
} else {
Write-Host ('Permission for {0} already exists on {1}.' -f $GroupName, $RegistryPath)
}
} else {
Write-Host ('The registry key {0} does not exist.' -f $RegistryPath)
}$RegistryPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\'
$Principal = 'APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES'
$Permission = [System.Security.AccessControl.RegistryRights]::ReadKey
# Check if the registry key exists.
if (Test-Path -Path $RegistryPath) {
# Get the current ACL for the registry key.
$ACL = Get-Acl -Path $RegistryPath
# Check if the group already has the specified permission.
$HasRequiredPermission = $false
foreach ($AccessRule in $ACL.Access) {
if ($AccessRule.IdentityReference -eq $Principal -and $AccessRule.RegistryRights -band $Permission) {
$HasRequiredPermission = $true
break
}
}
if (-not $HasRequiredPermission) {
Write-Host ('Required permissions missing for {0} on {1}.' -f $GroupName, $RegistryPath)
Write-Host ('Please run Repair-ActiveComputerNameRegistryKey to create the registry key and set the permissions.')
} else {
Write-Host ('Permission for {0} already exists on {1}.' -f $GroupName, $RegistryPath)
}
} else {
Write-Host ('The registry key {0} does not exist.' -f $RegistryPath)
}Remediation script attached:
$RegistryPath = 'HKLM:\SYSTEM\CurrentControlSet\Control'
$Principal = 'APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES'
$PrincipalSID = [System.Security.Principal.SecurityIdentifier]::new('S-1-15-2-1')
# Check if the registry key exists.
if (Test-Path -Path $RegistryPath) {
# Get the current ACL for the registry key.
$ACL = Get-Acl -Path $RegistryPath
# Build the new rule for the principal.
$Rule = [System.Security.AccessControl.RegistryAccessRule]::new(
$PrincipalSID,
[System.Security.AccessControl.RegistryRights]::ReadKey,
[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,
[System.Security.AccessControl.PropagationFlags]::None,
[System.Security.AccessControl.AccessControlType]::Allow
)
# Check if the group already has the specified permission.
$Exists = $false
foreach ($AccessRule in $ACL.Access) {
if ($AccessRule.IdentityReference -eq $PrincipalSID -and $AccessRule.RegistryRights -band [System.Security.AccessControl.RegistryRights]::ReadKey) {
$Exists = $true
Write-Host ('Permission for {0} already exists on {1}.' -f $Principal, $RegistryPath)
break
}
}
if (-not $Exists) {
Write-Host ('Adding permission for {0} on {1}.' -f $Principal, $RegistryPath)
# Add the new rule to the ACL.
$ACL.SetAccessRule($Rule)
# Set the updated ACL back to the registry key.
Set-Acl -Path $RegistryPath -AclObject $ACL
Write-Host ('Successfully added permission for {0} on {1}.' -f $Principal, $RegistryPath)
} else {
Write-Host ('Permission for {0} already exists on {1}.' -f $Principal, $RegistryPath)
}
} else {
Write-Host ('The registry key {0} does not exist.' -f $RegistryPath)
}$RegistryPath = 'HKLM:\SYSTEM\CurrentControlSet\Control'
$Principal = 'APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES'
$PrincipalSID = [System.Security.Principal.SecurityIdentifier]::new('S-1-15-2-1')
# Check if the registry key exists.
if (Test-Path -Path $RegistryPath) {
# Get the current ACL for the registry key.
$ACL = Get-Acl -Path $RegistryPath
# Build the new rule for the principal.
$Rule = [System.Security.AccessControl.RegistryAccessRule]::new(
$PrincipalSID,
[System.Security.AccessControl.RegistryRights]::ReadKey,
[System.Security.AccessControl.InheritanceFlags]::ContainerInherit,
[System.Security.AccessControl.PropagationFlags]::None,
[System.Security.AccessControl.AccessControlType]::Allow
)
# Check if the group already has the specified permission.
$Exists = $false
foreach ($AccessRule in $ACL.Access) {
if ($AccessRule.IdentityReference -eq $PrincipalSID -and $AccessRule.RegistryRights -band [System.Security.AccessControl.RegistryRights]::ReadKey) {
$Exists = $true
Write-Host ('Permission for {0} already exists on {1}.' -f $Principal, $RegistryPath)
break
}
}
if (-not $Exists) {
Write-Host ('Adding permission for {0} on {1}.' -f $Principal, $RegistryPath)
# Add the new rule to the ACL.
$ACL.SetAccessRule($Rule)
# Set the updated ACL back to the registry key.
Set-Acl -Path $RegistryPath -AclObject $ACL
Write-Host ('Successfully added permission for {0} on {1}.' -f $Principal, $RegistryPath)
} else {
Write-Host ('Permission for {0} already exists on {1}.' -f $Principal, $RegistryPath)
}
} else {
Write-Host ('The registry key {0} does not exist.' -f $RegistryPath)
}
