🛡️ Essential 8 Guide

Implementation guidance for Australian Essential Eight controls in Microsoft environments - ISM controls with PSPF mappings

About
HOME ← ISM-1703
ISM-1808 →

Office productivity suites, web browsers and their extensions, email clients, PDF applications, Adobe Flash Player, and security products that are no longer supported by vendors are removed.

Property Value
ISM Control ISM-1704
Revision 3
Updated Jun-25
Guideline Not provided
Section System patching
Topic Cessation of support
Essential Eight ML1, ML2, ML3
PSPF Levels NC, OS, P, S, TS

Summary

Removes software that is no longer supported by vendors from devices to reduce exposure to unpatched vulnerabilities and compatibility issues. Regularly review the detected application inventory via the Microsoft Defender admin portal and remove the identified applications using the current deployment mechanism.12

Justification

End-of-life (EOL) software receives no security patches from the vendor, meaning any newly discovered vulnerability will remain permanently unpatched. This makes EOL software a permanently exploitable condition rather than a temporary remediation gap.

Key examples relevant to this control:

Software EOL date Risk if retained
Adobe Flash Player December 2020 Permanently unpatched; browser and Windows updates actively block it
Internet Explorer 11 June 2022 MSHTML engine issues persist (see ISM-1654); Flash host remains
Office 2016/2019 October 2025/2026 After EOL, no macro, parsing or OLE vulnerabilities patched
Acrobat DC pre-2020 Various High-CVE-density product; EOL versions ship with unpatched parser vulns

Microsoft Defender Vulnerability Management surfaces end-of-support software as a distinct recommendation category, making inventory and identification straightforward.

Design Decision

[!NOTE] The Microsoft Defender admin portal will be used to review the detected applications on all devices, focusing on items no longer supported by vendors. The current deployment mechanism will be used to remove the identified applications as required.

Prerequisites

Implementation Steps

Inventory review and deployment-based removal

  1. Sign in to the Microsoft Intune admin center. 1
  2. Go to Apps > All Apps > the app > Assignments > Add group. 1
  3. In the Add group pane, select Uninstall. 1
  4. Select Included Groups to choose the groups of users affected by this uninstall. 1
  5. Select the groups to apply the uninstall assignment. 1
  6. Click Select on the Select groups pane. 1
  7. Click OK on the Assign pane to set the assignment. 1
  8. If you want to exclude any groups, select Exclude Groups. 1
  9. If you have chosen to exclude groups, in Select groups, select Select. 1
  10. Click OK in the Add group pane. 1
  11. Click Save in the app Assignments pane. 1

Policy-based in-box app removal

  1. In Intune, configure devices by creating a Settings catalog policy and use the following settings. 3
  2. Administrative Templates\Windows Components\App Package Deployment Remove default Microsoft Store packages from the system Enabled. 3
  3. Set the toggle to True for each app to remove it. 3
  4. Assign the policy to a group of devices you want to configure. After devices sync with Intune, the policy will apply at the next user provisioning or sign-in. 3
  5. Windows Autopilot: For Autopilot deployments, include the removal policy in the device’s configuration profiles and configure Enrollment Status Page (ESP) to block until device configuration is complete. App removal should happen during device setup if the policy arrives in time. 3

Policy-based in-box app removal (CSP/OMA-URI alternative)

  1. You can configure the RemoveDefaultMicrosoftStorePackages CSP policy to remove store packages. This ADMX-backed policy uses an XML payload. 3
  2. The policy payload can specify which apps to remove by including data blocks with app identifiers set to true to remove and false to keep. 3
  3. Assign the policy to the target group; after devices sync, the policy applies at next provisioning or sign-in. 3

IE11 and in-box app removal using a PowerShell script (optional)

  1. Add the UserApplicationHardening-RemoveFeatures.ps1 as a PowerShell script with the following options:
    • Run this script using the logged on credentials: No
    • Enforce script signature check: No
    • Run script in 64-bit PowerShell Host: No 4
  2. Assign the script to a deployment group. 4
  3. This script also disables .NET Framework 3.5 (includes .NET 2.0 and 3.0) and Windows PowerShell 2.0. 4

  1. Essential Eight patch applications ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15

  2. ASD Blueprint: Patch applications — ASD’s Blueprint for Secure Cloud ↩

  3. Policy-based in-box app removal ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10

  4. Essential Eight user application hardening ↩ ↩2 ↩3

HOME ← ISM-1703
ISM-1808 →