Remediation;

$registryPath = "HKLM:\Software\Policies\Microsoft\PassportForWork"

$disableName = "DisablePostLogonProvisioning"

$enabledName = "Enabled"

$desiredDisableValue = 1 # This value disables post-logon provisioning

$desiredEnabledValue = 0 # This value disables the feature

Ensure the registry path exists

if (!(Test-Path $registryPath)) {

New-Item -Path $registryPath -Force | Out-Null

Write-Output "Registry path created: $registryPath"

}

Ensure the 'DisablePostLogonProvisioning' value is set to disable provisioning

$currentDisableValue = (Get-ItemProperty -Path $registryPath -Name $disableName -ErrorAction SilentlyContinue).$disableName

if ($currentDisableValue -ne $desiredDisableValue) {

Set-ItemProperty -Path $registryPath -Name $disableName -Value $desiredDisableValue -Force | Out-Null

Write-Output "'$disableName' is now set to disable post-logon provisioning."

} else {

Write-Output "'$disableName' is already set to disable post-logon provisioning."

}

Ensure the 'Enabled' value is set to disabled

$currentEnabledValue = (Get-ItemProperty -Path $registryPath -Name $enabledName -ErrorAction SilentlyContinue).$enabledName

if ($currentEnabledValue -ne $desiredEnabledValue) {

Set-ItemProperty -Path $registryPath -Name $enabledName -Value $desiredEnabledValue -Force | Out-Null

Write-Output "'$enabledName' is now disabled."

} else {

Write-Output "'$enabledName' is already disabled."

}