CVE-2023-36884.ps1

#Requires -RunasAdministrator
#Requires -Modules ActiveDirectory,GroupPolicy

# Make sure we can reach the PDC
$PDC  = (Get-ADDomainController -Service 1 -Discover -ErrorAction SilentlyContinue).Hostname
if ($PDC) {

    # Get the domain name
    $DomainName = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().Name

    # Create the GPO
    if (-not($GPO = Get-GPO -Name 'Emergency: M365 CVE-2023-36884' -Domain "$($DomainName)" -ErrorAction SilentlyContinue)){
        try {
            $GPO = New-GPO -Name 'Emergency: M365 CVE-2023-36884' -Domain "$($DomainName)" -ErrorAction Stop
        } catch {
            Write-Warning -Message "Failed to create the M365 CVE-2023-36884 GPO because $($_.Exception.Message)"
        }
    }
    if ($GPO) {

        # Don't need user settings
        $GPO.GpoStatus = [Microsoft.GroupPolicy.GpoStatus]::UserSettingsDisabled

        # Main hashtable
        $HT = @{ GUID = ($GPO).Id ; ErrorAction = 'Stop' }

        @(
            'Excel.exe',
            'Graph.exe',
            'MSAccess.exe',
            'MSPub.exe',
            'Powerpnt.exe'
            'Visio.exe',
            'WinProj.exe',
            'WinWord.exe',
            'Wordpad.exe'
        ) |
        ForEach-Object {
            $reg = @{
                Key = 'HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BLOCK_CROSS_PROTOCOL_FILE_NAVIGATION' ;
                ValueName = $_ ; Type = 'DWORD' ; Value = 0x1
            }
            try {
                Set-GPRegistryValue @HT @reg
            } catch {
                Write-Warning -Message "Faile to set GPO setting because $($_.Exception.Message)"
            }
        }
    }
}