https://projectblack.io/blog/intune-registry-keys/

Set-Hardening-Keys.ps1

# --- Base functions ---
# Function to write log
function Write-Log {
    param (
        [string]$message
    )

    try {
        # Ensure the directory exists for logging
        $logDirectory = Split-Path -Path $logFile -Parent
        if (!(Test-Path -Path $logDirectory)) {
            New-Item -Path $logDirectory -ItemType Directory -Force -ErrorAction Stop | Out-Null
        }

        $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
        Add-Content -Path $logFile -Value "$timestamp - $message" -ErrorAction Stop 

        # Keep only the last 500 lines
        $maxLines = 500
        $lines = Get-Content -Path $logFile -ErrorAction Stop 
        if ($lines.Count -gt $maxLines) {
            $lines | Select-Object -Last $maxLines | Set-Content -Path $logFile -ErrorAction Stop 
        }
    }
    catch {
        # Write a message to the console if logging fails
        Write-Output "Error writing to log file: $($_.Exception.Message)"
        exit 1
    }
}
# Function to create or update registry key
function Set-RegistryKey {
    param (
        [string]$path,
        [string]$name,
        [string]$type,
        [string]$data
    )

    try {

        # Check if the registry path exists
        if (-not (Test-Path -Path $path)) {
            Write-Log "Registry path $path does not exist. Creating it."
            New-Item -Path $path -Force -ErrorAction Stop | Out-Null
            Write-Log "Created registry path $path"
        }

        # Check if the property (value name) exists
        $currentValue = Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue

        if ($currentValue) {
            # If the key exists, update it if necessary
            if ($currentValue.$name -ne $data) {
                Set-ItemProperty -Path $path -Name $name -Value $data -ErrorAction Stop
                Write-Log "Updated $name to $data at $path"
            }
            else {
                Write-Log "$name already set to $data at $path"
            }
        }
        else {
            # If the key does not exist, create it
            New-ItemProperty -Path $path -Name $name -PropertyType $type -Value $data -Force -ErrorAction Stop
            Write-Log "Created $name with value $data at $path"
        }
    }
    catch {
        Write-Log "Error setting $name at $path\: $($_.Exception.Message)"
        exit 1
    }
}


# --- Specific settings for this script ---
# --- HKLM, RUN AS SYSTEM, DELETE BLOCK YOU DON'T NEED ---
# Define the log file location
$logFile = "C:\ProgramData\IntuneScripts\StartupScriptChangeLog.txt"

# Define registry values to set 
$registrySettings = @(
    @{Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"; Name = "EnableNetbios"; Type = "DWORD"; Data = 0 },
    @{Path = "HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters"; Name = "EnableMDNS"; Type = "DWORD"; Data = 0 },
    @{Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"; Name = "EnableMulticast"; Type = "DWORD"; Data = 0 },
    @{Path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\WinHttp"; Name = "DisableWpad"; Type = "DWORD"; Data = 1 }
)
# --- HKLM, RUN AS SYSTEM, DELETE BLOCK YOU DON'T NEED ---

# --- HCKU, RUN AS USER, DELETE BLOCK YOU DON'T NEED ---
# Define the log file location
$logFile = "$env:LOCALAPPDATA\IntuneScripts\StartupScriptChangeLog.txt"

# Define registry values to set
$registrySettings = @(
    @{Path = "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"; Name = "AutoDetect"; Type = "DWORD"; Data = 0 }
)
# --- HCKU, RUN AS USER, DELETE BLOCK YOU DON'T NEED ---

# Set keys
foreach ($setting in $registrySettings) {
    $registryPath = $setting.Path
    $valueName = $setting.Name
    $valueType = $setting.Type
    $expectedValue = $setting.Data
    Set-RegistryKey -path $registryPath -name $valueName -type $valueType -data $expectedValue
}

exit 0