Deny_OneNote_Malware.ps1

#Run as Administrator, copy/paste the below

# Mount HKU  
mount -PSProvider Registry -Name HKU -Root HKEY_USERS;

# Loop through each HKU/user's HKCU, AND deploy OneNote defences 
(gci -path "HKU:\*\Software\Microsoft\Office\*\OneNote\Options\").PsPath | 
Foreach-Object {New-ItemProperty -Path $_ -Name "disableembeddedfiles" -Value 1 -type DWORD -verbose};

(gci -path "HKU:\*\Software\Microsoft\Office\*\OneNote\Options\").PsPath | 
Foreach-Object {New-Item -Path "$_\embeddedfileopenoptions" -verbose};

(gci -path "HKU:\*\Software\Microsoft\Office\*\OneNote\Options\").PsPath |
Foreach-Object {New-ItemProperty -Path "$_\embeddedfileopenoptions" -Name "blockedextensions" -type string -value ".js;.exe;.bat;.vbs;.com;.scr;.cmd;.ps1" -verbose}