Score

100%
Adjusted Score:100%
Original Score:100%
Compliance Status:BLUE

Pass:134Not Applicable:0
Fail:0Not Checked:0
Error:0Not Selected:0
Unknown:0Informational:0
Fixed:0Total:134
BLUE:Score equals 100
GREEN:Score is greater than or equal to 90
YELLOW:Score is greater than or equal to 80
RED:Score is greater than or equal to 0

System Information

Target Hostname:IP-AC100216
Operating System:Windows Server 2016 Datacenter
OS Version:1607
Domain: 
FQDN:IP-AC100216.
Processor:Intel(R) Xeon(R) CPU E5-2676 v3 @ 2.40GHz
Processor Architecture:Intel64 Family 6 Model 63 Stepping 2
Processor Speed:2399 mhz
Physical Memory:1024 mb
Manufacturer:Xen
Model:HVM domU
Serial Number:ec2326ac-520a-95f4-41de-2b0c5dc41b44
BIOS Version:4.2.amazon
Interfaces:
  • [00000001] AWS PV Network Device
    • IP Addresses
      • 172.16.2.22
    • MAC Address: 16:5E:4E:98:57:A3

Content Information

Stream:IE_11_STIG
Profile:
Id:MAC-1_Classified
Digital Signature Status:NOT DIGITALLY SIGNED
Stream Installation Date:2021-02-26
Status:accepted (2020-06-08)
Title:Microsoft Internet Explorer 11 Security Technical Implementation Guide
Description:The Microsoft Internet Explorer 11 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil
Notice: 
Target Platforms:
  • cpe:/a:microsoft:internet_explorer:11
Reference:
Href:https://cyber.mil/
Publisher:DISA
Source:STIG.DOD.MIL
Stream Version:001.015
Start Time:2021-02-26T19:29:08
End Time:2021-02-26T19:29:16
Scanner:cpe:/a:spawar:scc:5.3.1
Identity:IP-AC100216\ec2-user
Identity Privileged:true
Identity Authenticated:true
Release Info:Release: 1.15 Benchmark Date: 24 Jul 2020

Results

Detailed Results

Turn off Encryption Support must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-59337r8_rule
Result:Pass
Version:DTBI014-IE11
Identities:CCI-002450 (NIST SP 800-53 Rev 4: SC-13)
Description: This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match.. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Advanced Page >> "Turn off Encryption Support" to "Enabled".

Select only "Use TLS 1.1" and "Use TLS 1.2" from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:580
Result:true
Title:Turn off Encryption Support must be enabled.
Description:This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by allowing you to turn on/off support for TLS and SSL. TLS is a protocol for protecting communications between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other's list of supported protocols and versions and pick the most preferred match
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58000 (registry_test)
Result:true
Title:'turn off encryption support' setting is handled by Group Policy.
Check Existence:One or more collected items must exist.
Check:Result is based on check existence only.
Object ID:oval:mil.disa.fso.ie:obj:58000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'SecureProtocols'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'SecureProtocols'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '2560'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58001 (registry_test)
Result:true
Title:TLS 1, 1.1, and 1.2 must be selected for the IE option 'turn off encryption support' via Group Policy.
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'SecureProtocols'
State ID:oval:mil.disa.fso.ie:ste:58000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '2560'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'SecureProtocols'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '2560'
  • windows_view equals '64_bit'

The Internet Explorer warning about certificate address mismatch must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59339r1_rule
Result:Pass
Version:DTBI015-IE11
Identities:CCI-001274 (NIST SP 800-53: SI-4 (12); NIST SP 800-53A: SI-4 (12).1 (ii); NIST SP 800-53 Rev 4: SI-4 (12))
Description: This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page 'Turn on certificate address mismatch warning' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:421
Result:true
Title:DTBI015-IE11 Warning of invalid certificates
Description:This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the user of a potential issue with the certificate being presented by the web server. This setting aids to prevent spoofing attacks.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42100 (registry_test)
Result:true
Title:Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Turn on certificate address mismatch warning
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'WarnOnBadCertRecving'
State ID:oval:mil.disa.fso.ie:ste:42100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'WarnOnBadCertRecving'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

The Download signed ActiveX controls property must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59345r1_rule
Result:Pass
Version:DTBI022-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by untrusted publishers. Code signed by trusted publishers is silently downloaded. If you disable the policy setting, signed controls cannot be downloaded. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download signed ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:422
Result:true
Title:DTBI022-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Download signed ActiveX controls
Description:This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Download signed ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1001'
State ID:oval:mil.disa.fso.ie:ste:42200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1001'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Download unsigned ActiveX controls property must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59347r1_rule
Result:Pass
Version:DTBI023-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If you enable this policy setting, users can run unsigned controls without user intervention. If you select "Prompt" in the drop-down box, users are queried to choose whether to allow the unsigned control to run. If you disable this policy setting, users cannot run unsigned controls. If you do not configure this policy setting, users cannot run unsigned controls. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Download unsigned ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:423
Result:true
Title:DTBI023-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Download unsigned ActiveX controls
Description:This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Download unsigned ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1004'
State ID:oval:mil.disa.fso.ie:ste:42300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1004'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59365r1_rule
Result:Pass
Version:DTBI024-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Initialize and script ActiveX controls not marked as safe' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:424
Result:true
Title:DTBI024-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Initialize and script ActiveX controls not marked as safe
Description:This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42400 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Initialize and script ActiveX controls not marked as safe
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1201'
State ID:oval:mil.disa.fso.ie:ste:42400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1201'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Java permissions must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59371r1_rule
Result:Pass
Version:DTBI031-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:426
Result:true
Title:DTBI031-IE11 - The Java Permissions must be disallowed (Internet zone)
Description:Java application could contain malicious code, sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42600 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:42600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Accessing data sources across domains must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59373r1_rule
Result:Pass
Version:DTBI032-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be controlled based upon the site being browsed. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Access data sources across domains' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:427
Result:true
Title:DTBI032-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Access data sources across domains
Description:This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Access data sources across domains
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1406'
State ID:oval:mil.disa.fso.ie:ste:42700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1406'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Functionality to drag and drop or copy and paste files must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59375r1_rule
Result:Pass
Version:DTBI036-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow drag and drop or copy and paste files' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:428
Result:true
Title:DTBI036-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow drag and drop or copy and paste files
Description:This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow drag and drop or copy and paste files
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1802'
State ID:oval:mil.disa.fso.ie:ste:42800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1802'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Launching programs and files in IFRAME must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59377r1_rule
Result:Pass
Version:DTBI038-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Launching applications and files in an IFRAME' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:429
Result:true
Title:DTBI038-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Launching applications and files in an IFRAME
Description:This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:42900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Launching applications and files in an IFRAME
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:42900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1804'
State ID:oval:mil.disa.fso.ie:ste:42900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1804'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Navigating windows and frames across different domains must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59379r1_rule
Result:Pass
Version:DTBI039-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross-site scripting (XSS). This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Navigate windows and frames across different domains' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:430
Result:true
Title:DTBI039-IE11 - Navigating windows and frames across different domains must be disallowed (Internet zone)
Description:Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a web site hosting malicious content could use this feature in a manner similar to cross site scripting. This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43000 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Navigate windows and frames across different domains
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1607'
State ID:oval:mil.disa.fso.ie:ste:43000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1607'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Userdata persistence must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59381r1_rule
Result:Pass
Version:DTBI042-IE11
Identities:CCI-001199 (NIST SP 800-53: SC-28; NIST SP 800-53A: SC-28.1; NIST SP 800-53 Rev 4: SC-28)
Description: Userdata persistence must have a level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against visitors browsing the site. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Userdata persistence' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:431
Result:true
Title:DTBI042-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Userdata persistence
Description:This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Userdata persistence
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1606'
State ID:oval:mil.disa.fso.ie:ste:43100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1606'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Clipboard operations via script must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59385r1_rule
Result:Pass
Version:DTBI044-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have a level of protection based upon the site being accessed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow cut, copy or paste operations from the clipboard via script' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:432
Result:true
Title:DTBI044-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow cut, copy, or paste operations from the clipboard via script
Description:This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow cut, copy, or paste operations from the clipboard via script
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1407'
State ID:oval:mil.disa.fso.ie:ste:43200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1407'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Logon options must be configured to prompt (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59387r1_rule
Result:Pass
Version:DTBI046-IE11
Identities:CCI-001184 (NIST SP 800-53: SC-23; NIST SP 800-53A: SC-23.1; NIST SP 800-53 Rev 4: SC-23)
Description: Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to the websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”, but configuring this setting to “Enabled”; “Prompt for user name and password”, provides a reasonable balance between security and usability. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Logon options' to 'Enabled', and select 'Prompt for user name and password' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:433
Result:true
Title:DTBI046-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Logon options
Description:This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Logon options
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1A00'
State ID:oval:mil.disa.fso.ie:ste:43300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '65536'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1A00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '65536'
  • windows_view equals '64_bit'

Java permissions must be configured with High Safety (Intranet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59389r1_rule
Result:Pass
Version:DTBI061-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Intranet Zone -> 'Java permissions' to 'Enabled', and select 'High Safety' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:434
Result:true
Title:DTBI061-IE11 - Java Permissions must be configured with High Safety (Intranet zone)
Description:Java application could contain malicious code, sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:43400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '65536'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '65536'
  • windows_view equals '64_bit'

Java permissions must be configured with High Safety (Trusted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59407r1_rule
Result:Pass
Version:DTBI091-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Trusted Sites Zone -> 'Java permissions' to 'Enabled', and select 'High Safety' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:435
Result:true
Title:DTBI091-IE11 - The Java Permissions must be set with High Safety (Trusted Sites zone)
Description:Java application could contain malicious code, sites located in this security zone are more likely to be hosted by malicious people. This policy setting allows you to manage permissions for Java Applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Low Safety enables applets to perform all operations. Medium Safety enables applets to run in their sandbox. High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43500 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:43500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '65536'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '65536'
  • windows_view equals '64_bit'

Dragging of content from different domains within a window must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59409r1_rule
Result:Pass
Version:DTBI1000-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog box. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog box. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains within a window' to 'Enabled', and select 'Disabled' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:549
Result:true
Title:DTBI1000-IE11 - Content from different domains within windows - Internet zone
Description:This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:54900 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Enable dragging of content from different domains within a window
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:54900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2708'
State ID:oval:mil.disa.fso.ie:ste:54900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2708'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Dragging of content from different domains across windows must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59411r1_rule
Result:Pass
Version:DTBI1005-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you enable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog box. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains across windows' to 'Enabled', and select 'Disabled' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:548
Result:true
Title:DTBI1005-IE11 - Content from different domains across windows - Restricted zone
Description:This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you enable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:54800 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer-> Internet Control Panel\Security Page\Restricted Sites Zone\Enable dragging of content from different domains across windows
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:54800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2709'
State ID:oval:mil.disa.fso.ie:ste:54800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2709'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59413r1_rule
Result:Pass
Version:DTBI1010-IE11
Identities:CCI-001695 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:535
Result:true
Title:DTBI1010-IE11 - Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer)
Description:Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user?s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53500 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install\Internet Explorer Processes must be Enabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:53500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes Restrict ActiveX Install must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59417r1_rule
Result:Pass
Version:DTBI1020-IE11
Identities:CCI-001695 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:536
Result:true
Title:DTBI1020-IE11 - Internet Explorer Processes Restrict ActiveX Install must be enforced (IExplore)
Description:Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user?s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53600 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install\Internet Explorer Processes must be Enabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:53600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Dragging of content from different domains within a window must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59419r1_rule
Result:Pass
Version:DTBI1025-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog box. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog box. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Restricted Sites Zone 'Enable dragging of content from different domains within a window' to 'Enabled', and select 'Disabled' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:550
Result:true
Title:DTBI1025-IE11 - Content from different domains within windows - Restricted zone
Description:This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:55000 (registry_test)
Result:true
Title:Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone/Enable dragging of content from different domains within a window
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:55000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2708'
State ID:oval:mil.disa.fso.ie:ste:55000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2708'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Download signed ActiveX controls property must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59437r1_rule
Result:Pass
Version:DTBI112-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine its author, but it is still potentially harmful, especially when coming from an untrusted zone. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download signed ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:436
Result:true
Title:DTBI112-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Download signed ActiveX controls
Description:This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43600 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Download signed ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1001'
State ID:oval:mil.disa.fso.ie:ste:43600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1001'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59439r1_rule
Result:Pass
Version:DTBI113-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. They must also be digitally signed. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Download unsigned ActiveX controls' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:437
Result:true
Title:DTBI113-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Download unsigned ActiveX controls
Description:This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Download unsigned ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1004'
State ID:oval:mil.disa.fso.ie:ste:43700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1004'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59441r1_rule
Result:Pass
Version:DTBI114-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Initialize and script ActiveX controls not marked as safe' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:438
Result:true
Title:DTBI114-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Initialize and script ActiveX controls not marked as safe
Description:This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Initialize and script ActiveX controls not marked as safe
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1201'
State ID:oval:mil.disa.fso.ie:ste:43800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1201'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

ActiveX controls and plug-ins must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59443r1_rule
Result:Pass
Version:DTBI115-IE11
Identities:CCI-001687 (NIST SP 800-53: SC-18 (2); NIST SP 800-53A: SC-18 (2).1 (ii); NIST SP 800-53 Rev 4: SC-18 (2))
Description: This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you enable this policy setting, controls and plug-ins can run without user intervention. If you disable this policy setting, controls and plug-ins are prevented from running. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run ActiveX controls and plugins' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:439
Result:true
Title:DTBI115-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run ActiveX controls and plugins
Description:This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. If you enable this policy setting, controls and plug-ins can run without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:43900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run ActiveX controls and plugins
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:43900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1200'
State ID:oval:mil.disa.fso.ie:ste:43900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1200'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59445r1_rule
Result:Pass
Version:DTBI116-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. ActiveX controls not marked as safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Script ActiveX controls marked safe for scripting' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:440
Result:true
Title:DTBI116-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Script ActiveX controls marked safe for scripting
Description:This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44000 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Script ActiveX controls marked safe for scripting
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1405'
State ID:oval:mil.disa.fso.ie:ste:44000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1405'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

File downloads must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59447r1_rule
Result:Pass
Version:DTBI119-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from sites that are considered restricted. This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow file downloads' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:441
Result:true
Title:DTBI119-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow file downloads
Description:This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow file downloads
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1803'
State ID:oval:mil.disa.fso.ie:ste:44100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1803'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Java permissions must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59451r1_rule
Result:Pass
Version:DTBI121-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:453
Result:true
Title:DTBI121-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Java permissions
Description:This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:45300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:45300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:45300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Accessing data sources across domains must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59453r1_rule
Result:Pass
Version:DTBI122-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Access data sources across domains' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:443
Result:true
Title:DTBI122-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Access data sources across domains
Description:This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Access data sources across domains
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1406'
State ID:oval:mil.disa.fso.ie:ste:44300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1406'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Allow META REFRESH property must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59455r1_rule
Result:Pass
Version:DTBI123-IE11
Identities:CCI-000366 (NIST SP 800-53: CM-6 b; NIST SP 800-53A: CM-6.1 (iv); NIST SP 800-53 Rev 4: CM-6 b)
Description: It is possible that users will unknowingly be redirected to a site hosting malicious content. 'Allow META REFRESH' must have a level of protection based upon the site being browsed. This policy setting allows you to manage whether a user's browser can be redirected to another web page if the author of the web page uses the Meta Refresh setting to redirect browsers to another web page. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow META REFRESH' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:444
Result:true
Title:DTBI123-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow META REFRESH
Description:This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44400 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow META REFRESH
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1608'
State ID:oval:mil.disa.fso.ie:ste:44400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1608'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59457r1_rule
Result:Pass
Version:DTBI126-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must have a level of protection based upon the site being accessed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow drag and drop or copy and paste files' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:445
Result:true
Title:DTBI126-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow drag and drop or copy and paste files
Description:This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44500 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow drag and drop or copy and paste files
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1802'
State ID:oval:mil.disa.fso.ie:ste:44500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1802'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Launching programs and files in IFRAME must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59461r1_rule
Result:Pass
Version:DTBI128-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME must have a level of protection based upon the site being accessed. If you enable this policy setting, applications can run and files can be downloaded from IFRAMEs on the pages in this zone without user intervention. If you disable this setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Launching applications and files in an IFRAME' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:447
Result:true
Title:DTBI128-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Launching applications and files in an IFRAME
Description:This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Launching applications and files in an IFRAME
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1804'
State ID:oval:mil.disa.fso.ie:ste:44700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1804'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Navigating windows and frames across different domains must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59463r1_rule
Result:Pass
Version:DTBI129-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is possible that a website hosting malicious content could use this feature in a manner similar to cross-site scripting (XSS). This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Navigate windows and frames across different domains' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:448
Result:true
Title:DTBI129-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Navigate windows and frames across different domains
Description:This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Navigate windows and frames across different domains
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1607'
State ID:oval:mil.disa.fso.ie:ste:44800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1607'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Userdata persistence must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59465r1_rule
Result:Pass
Version:DTBI132-IE11
Identities:CCI-001199 (NIST SP 800-53: SC-28; NIST SP 800-53A: SC-28.1; NIST SP 800-53 Rev 4: SC-28)
Description: Userdata persistence must have a level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in Favorites, in an XML store, or directly within a web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is not appropriately configured. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Userdata persistence' to 'Enabled', and select 'Disable' from the drop-down box
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:449
Result:true
Title:DTBI132-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Userdata persistence
Description:This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:44900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Userdata persistence
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:44900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1606'
State ID:oval:mil.disa.fso.ie:ste:44900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1606'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Active scripting must be disallowed (Restricted Sites Zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59467r1_rule
Result:Pass
Version:DTBI133-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy setting allows you to manage whether script code on pages in the zone are run. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow active scripting' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:450
Result:true
Title:DTBI133-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow active scripting
Description:This policy setting allows you to manage whether script code on pages in the zone is run. If you enable this policy setting, script code on pages in the zone can run automatically.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:45000 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow active scripting
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:45000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1400'
State ID:oval:mil.disa.fso.ie:ste:45000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1400'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Clipboard operations via script must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59469r1_rule
Result:Pass
Version:DTBI134-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious script could harvest that information. It might be possible to exploit other vulnerabilities in order to send the harvested data to the attacker. Allow paste operations via script must have a level of protection based upon the site being accessed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow cut, copy or paste operations from the clipboard via script' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:451
Result:true
Title:DTBI134-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow cut, copy, or paste operations from the clipboard via script
Description:This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:45100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow cut, copy, or paste operations from the clipboard via script
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:45100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1407'
State ID:oval:mil.disa.fso.ie:ste:45100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1407'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Logon options must be configured and enforced (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59471r1_rule
Result:Pass
Version:DTBI136-IE11
Identities:CCI-001184 (NIST SP 800-53: SC-23; NIST SP 800-53A: SC-23.1; NIST SP 800-53 Rev 4: SC-23)
Description: Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user credentials, automatic logon performance, and how default Windows credentials are passed to the websites. This policy setting allows management of settings for logon options. If you enable this policy setting, you can choose from varying logon options. “Anonymous logon” disables HTTP authentication and uses the guest account only for the Common Internet File System (CIFS) protocol. “Prompt for user name and password” queries users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon only in Intranet zone” queries users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session. “Automatic logon with current user name and password” attempts logon using Windows NT Challenge Response. If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for login. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password. If you disable this policy setting, logon is set to “Automatic logon only in Intranet zone”. If you do not configure this policy setting, logon is set to “Automatic logon only in Intranet zone”. The most secure option is to configure this setting to “Enabled”; “Anonymous logon”. This will prevent users from submitting credentials to servers in this security zone. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Logon options' to 'Enabled', and select 'Anonymous logon' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:452
Result:true
Title:DTBI136-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Logon options
Description:This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:45200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Logon options
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:45200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1A00'
State ID:oval:mil.disa.fso.ie:ste:45200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '196608'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1A00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '196608'
  • windows_view equals '64_bit'

Configuring History setting must be set to 40 days.

Rule ID:xccdf_mil.disa.stig_rule_SV-59473r1_rule
Result:Pass
Version:DTBI300-IE11
Identities:CCI-000169 (NIST SP 800-53: AU-12 a; NIST SP 800-53A: AU-12.1 (ii); NIST SP 800-53 Rev 4: AU-12 a)
Description: This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, "General" tab, and then click Settings under Browsing History. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. The number of days that Internet Explorer keeps track of the pages viewed in the History List must be specified. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List. Users can delete browsing history. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Disable Configuring History' to 'Enabled', and enter '40' in 'Days to keep pages in History'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:513
Result:true
Title:DTBI300-IE11 - Configuring History setting must be set to 40 days
Description:This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, General tab, and then click Settings under Browsing History. If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. You must specify the number of days that Internet Explorer keeps track of the pages viewed in the History List. Users will not be able to delete browsing history. If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List. Users can delete browsing history.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51301 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History\Disable Configuring History must be Enabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51301 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Control Panel'
  • name must be equal to 'History'
State ID:oval:mil.disa.fso.ie:ste:51301 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Control Panel'
  • name equals 'History'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:51300 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History\40 entered in Days to keep pages in History
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History'
  • name must be equal to 'DaysToKeep'
State ID:oval:mil.disa.fso.ie:ste:51300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '40'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History'
  • name equals 'DaysToKeep'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '40'
  • windows_view equals '64_bit'

Internet Explorer must be set to disallow users to add/delete sites.

Rule ID:xccdf_mil.disa.stig_rule_SV-59479r1_rule
Result:Pass
Version:DTBI318-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system. If you do not configure this policy setting, users will be able to add or remove sites from the Trusted Sites and Restricted Sites zones at will and change settings in the Local Intranet zone. This configuration could allow sites that host malicious mobile code to be added to these zones, and users could execute the code. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to add/delete sites' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:419
Result:true
Title:Computer Configuration\Network\Internet Explorer\Security Zones: Do Not Allow Users to Add/Delete Sites
Description:The Security Zones: Do not allow users to add/delete sites setting prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:41900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Security Zones: Do Not Allow Users to Add/Delete Sites
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:41900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'Security_zones_map_edit'
State ID:oval:mil.disa.fso.ie:ste:41900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'Security_zones_map_edit'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer must be configured to disallow users to change policies.

Rule ID:xccdf_mil.disa.stig_rule_SV-59481r1_rule
Result:Pass
Version:DTBI319-IE11
Identities:CCI-000345 (NIST SP 800-53: CM-5; NIST SP 800-53A: CM-5.1; NIST SP 800-53 Rev 4: CM-5)
Description: Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting prevents users from changing the Internet Explorer policies on the machine. Policy changes should be made by administrators only, so this setting should be enabled. If you enable this policy setting, you disable the "Custom level" button and "Security" level for this zone slider on the Security tab in the Internet Options dialog box. If this policy setting is disabled or not configured, users will be able to change the settings for security zones. It prevents users from changing security zone policy settings that are established by the administrator. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Do not allow users to change policies' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:418
Result:true
Title:DTBI319-IE11 - Computer Configuration\Network\Internet Explorer\Security Zones: Do Not Allow Users to Change Policies
Description:The Security Zones: Do not allow users to change policies setting prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:41800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Security Zones: Do Not Allow Users to Change Policies
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:41800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'Security_options_edit'
State ID:oval:mil.disa.fso.ie:ste:41800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'Security_options_edit'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer must be configured to use machine settings.

Rule ID:xccdf_mil.disa.stig_rule_SV-59483r1_rule
Result:Pass
Version:DTBI320-IE11
Identities:CCI-000345 (NIST SP 800-53: CM-5; NIST SP 800-53A: CM-5.1; NIST SP 800-53 Rev 4: CM-5)
Description: Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser. This setting enforces consistent security zone settings to all users of the computer. Security zones control browser behavior at various websites and it is desirable to maintain a consistent policy for all users of a machine. This policy setting affects how security zone changes apply to different users. If you enable this policy setting, changes that one user makes to a security zone will apply to all users of that computer. If this policy setting is disabled or not configured, users of the same computer are allowed to establish their own security zone settings. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer 'Security Zones: Use only machine settings' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:417
Result:true
Title:DTBI320-IE11 - Computer Configuration\Network\Internet Explorer\Security Zones: Use Only Machine Settings
Description:Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level. If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:41700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Security Zones: Use Only Machine Settings
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:41700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'Security_HKLM_only'
State ID:oval:mil.disa.fso.ie:ste:41700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'Security_HKLM_only'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Security checking features must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59485r1_rule
Result:Pass
Version:DTBI325-IE11
Identities:CCI-000366 (NIST SP 800-53: CM-6 b; NIST SP 800-53A: CM-6.1 (iv); NIST SP 800-53 Rev 4: CM-6 b)
Description: This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this policy setting, the security settings check will not be performed. If you disable or do not configure this policy setting, the security settings check will be performed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off the Security Settings Check feature' to 'Disabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:457
Result:true
Title:DTBI325-IE11 - Computer Configuration\Network\Internet Explorer\Turn off the Security Settings Check feature
Description:This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:45700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Turn off the Security Settings Check feature
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:45700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Security'
  • name must be equal to 'DisableSecuritySettingsCheck'
State ID:oval:mil.disa.fso.ie:ste:45700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Security'
  • name equals 'DisableSecuritySettingsCheck'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Software must be disallowed to run or install with invalid signatures.

Rule ID:xccdf_mil.disa.stig_rule_SV-59489r2_rule
Result:Pass
Version:DTBI350-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure unmodified software is downloaded and the user can positively identify the signer to determine whether you trust them enough to run their software. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Allow software to run or install even if the signature is invalid' to 'Disabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:459
Result:true
Title:DTBI350-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Advanced Page \Allow Software to Run or Install Even if the Signature is Invalid
Description:Microsoft ActiveX controls and file downloads often have digital signatures attached that vouch for both the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure that unmodified.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:45900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Advanced Page \Allow Software to Run or Install Even if the Signature is Invalid
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:45900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Download'
  • name must be equal to 'RunInvalidSignatures'
State ID:oval:mil.disa.fso.ie:ste:45900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Download'
  • name equals 'RunInvalidSignatures'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Checking for server certificate revocation must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59493r2_rule
Result:Pass
Version:DTBI365-IE11
Identities:CCI-000185 (NIST SP 800-53: IA-5 (2); NIST SP 800-53A: IA-5 (2).1; NIST SP 800-53 Rev 4: IA-5 (2) (a))
Description: This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked. If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked. false
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for server certificate revocation' to 'Enabled'.
Severity:low
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:461
Result:true
Title:DTBI365-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Advanced Page \Check for Server Certificate Revocation
Description:This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Advanced Page \Check for Server Certificate Revocation
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'CertificateRevocation'
State ID:oval:mil.disa.fso.ie:ste:46100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'CertificateRevocation'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Checking for signatures on downloaded programs must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59497r1_rule
Result:Pass
Version:DTBI370-IE11
Identities:CCI-001749 (NIST SP 800-53 Rev 4: CM-5 (3))
Description: This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to the user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to the user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to the user computers. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> 'Check for signatures on downloaded programs' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:462
Result:true
Title:DTBI370-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Advanced Page \Check for Signature on Downloaded Programs
Description:This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Advanced Page \Check for Signature on Downloaded Programs
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Download'
  • name must be equal to 'CheckExeSignatures'
State ID:oval:mil.disa.fso.ie:ste:46200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • for all value, the following must be true:
    • value must be equal to 'yes'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Download'
  • name equals 'CheckExeSignatures'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals 'yes'
  • windows_view equals '64_bit'

All network paths (UNCs) for Intranet sites must be disallowed.

Rule ID:xccdf_mil.disa.stig_rule_SV-59499r1_rule
Result:Pass
Version:DTBI375-IE11
Identities:CCI-000366 (NIST SP 800-53: CM-6 b; NIST SP 800-53A: CM-6.1 (iv); NIST SP 800-53 Rev 4: CM-6 b)
Description: Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites zone. This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there). If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> 'Intranet Sites: Include all network paths (UNCs)' to 'Disabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:463
Result:true
Title:DTBI375-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Intranet Sites: Include all network paths (UNCs)
Description:This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Intranet Sites: Include all network paths (UNCs)
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap'
  • name must be equal to 'UNCAsIntranet'
State ID:oval:mil.disa.fso.ie:ste:46300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap'
  • name equals 'UNCAsIntranet'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Script-initiated windows without size or position constraints must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59501r1_rule
Result:Pass
Version:DTBI385-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow script-initiated windows without size or position constraints' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:464
Result:true
Title:DTBI385-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow script-initiated windows without size or position constraints
Description:This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46400 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow script-initiated windows without size or position constraints
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2102'
State ID:oval:mil.disa.fso.ie:ste:46400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2102'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59503r1_rule
Result:Pass
Version:DTBI390-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature. If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows including the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow script-initiated windows without size or position constraints' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:465
Result:true
Title:DTBI390-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow script-initiated windows without size or position constraints
Description:This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46500 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow script-initiated windows without size or position constraints
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2102'
State ID:oval:mil.disa.fso.ie:ste:46500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2102'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Scriptlets must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59505r1_rule
Result:Pass
Version:DTBI395-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow Scriptlets' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:466
Result:true
Title:DTBI395-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow Scriptlets
Description:This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46600 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow Scriptlets
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1209'
State ID:oval:mil.disa.fso.ie:ste:46600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1209'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Automatic prompting for file downloads must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59507r1_rule
Result:Pass
Version:DTBI415-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Automatic prompting for file downloads' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:467
Result:true
Title:DTBI415-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Automatic prompting for file downloads
Description:This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Automatic prompting for file downloads
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2200'
State ID:oval:mil.disa.fso.ie:ste:46700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2200'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Java permissions must be disallowed (Local Machine zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59509r1_rule
Result:Pass
Version:DTBI425-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Local Machine Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:468
Result:true
Title:DTBI425-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone\Java permissions
Description:This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:46800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Java permissions must be disallowed (Locked Down Local Machine zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59511r1_rule
Result:Pass
Version:DTBI430-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Local Machine Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:469
Result:true
Title:DTBI430-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down Local Machine Zone\Java permissions
Description:This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:46900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down Local Machine Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:46900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:46900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Java permissions must be disallowed (Locked Down Intranet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59513r1_rule
Result:Pass
Version:DTBI435-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Intranet Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:470
Result:true
Title:DTBI435-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down Intranet Zone\Java permissions
Description:This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:47000 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down Intranet Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:47000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:47000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Java permissions must be disallowed (Locked Down Trusted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59517r1_rule
Result:Pass
Version:DTBI440-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Trusted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:471
Result:true
Title:DTBI440-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down Trusted Sites Zone\Java permissions
Description:This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:47100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down Trusted Sites Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:47100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:47100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Java permissions must be disallowed (Locked Down Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59527r1_rule
Result:Pass
Version:DTBI450-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down box. Use of the Custom permission will control permissions settings individually. Use of the Low Safety permission enables applets to perform all operations. Use of the Medium Safety permission enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus adds capabilities like scratch space (a safe and secure storage area on the client computer) and a user-controlled file I/O. Use of the High Safety permission enables applets to run in their sandbox. If you disable this policy setting, Java applets cannot run. If you do not configure this policy setting, the permission is set to High Safety. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Locked-Down Restricted Sites Zone -> 'Java permissions' to 'Enabled', and select 'Disable Java' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:473
Result:true
Title:DTBI450-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down restricted Sites Zone\Java permissions
Description:This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:47300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Locked Down restricted Sites Zone\Java permissions
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:47300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4'
  • name must be equal to '1C00'
State ID:oval:mil.disa.fso.ie:ste:47300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4'
  • name equals '1C00'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

XAML files must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59529r1_rule
Result:Pass
Version:DTBI455-IE11
Identities:CCI-000366 (NIST SP 800-53: CM-6 b; NIST SP 800-53A: CM-6.1 (iv); NIST SP 800-53 Rev 4: CM-6 b)
Description: These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow loading of XAML files' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:474
Result:true
Title:DTBI455-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Loose or un-compiled XAML files
Description:These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:47400 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Loose or un-compiled XAML files
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:47400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2402'
State ID:oval:mil.disa.fso.ie:ste:47400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2402'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

XAML files must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59533r1_rule
Result:Pass
Version:DTBI460-IE11
Identities:CCI-000366 (NIST SP 800-53: CM-6 b; NIST SP 800-53A: CM-6.1 (iv); NIST SP 800-53 Rev 4: CM-6 b)
Description: These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. If you enable this policy setting and the drop-down box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the drop-down box is set to Prompt, users will receive a prompt for loading XAML files. If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior. If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow loading of XAML files' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:475
Result:true
Title:DTBI460-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Loose XAML files
Description:These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:47500 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Loose XAML files
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:47500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2402'
State ID:oval:mil.disa.fso.ie:ste:47500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2402'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Protected Mode must be enforced (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59545r1_rule
Result:Pass
Version:DTBI485-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off Protected Mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on Protected Mode. If you do not configure this policy, users will be able to turn on or off Protected Mode. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Protected Mode' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:480
Result:true
Title:DTBI485-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Turn On Protected Mode
Description:The 'Turn on Protected Mode' setting should be configured correctly for the Internet Zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48000 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Turn On Protected Mode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2500'
State ID:oval:mil.disa.fso.ie:ste:48000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2500'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Protected Mode must be enforced (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59549r1_rule
Result:Pass
Version:DTBI490-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: Protected Mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off Protected Mode. If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on Protected Mode. If you do not configure this policy, users will be able to turn on or off Protected Mode. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Protected Mode' to 'Enabled' and select 'Enable', from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:481
Result:true
Title:DTBI490-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Turn On Protected Mode
Description:The 'Turn on Protected Mode' setting should be configured correctly for the Restricted Sites Zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Turn On Protected Mode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2500'
State ID:oval:mil.disa.fso.ie:ste:48100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2500'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Pop-up Blocker must be enforced (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59553r1_rule
Result:Pass
Version:DTBI495-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Use Pop-up Blocker' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:482
Result:true
Title:DTBI495-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Use Pop-up Blocker
Description:This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Use Pop-up Blocker
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1809'
State ID:oval:mil.disa.fso.ie:ste:48200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1809'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Pop-up Blocker must be enforced (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59555r1_rule
Result:Pass
Version:DTBI500-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. If you disable this policy setting, pop-up windows are not prevented from appearing. If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Use Pop-up Blocker' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:483
Result:true
Title:DTBI500-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Use Pop-up Blocker
Description:This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Use Pop-up Blocker
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1809'
State ID:oval:mil.disa.fso.ie:ste:48300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1809'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Websites in less privileged web content zones must be prevented from navigating into the Internet zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59557r1_rule
Result:Pass
Version:DTBI515-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If "Prompt" is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:484
Result:true
Title:DTBI515-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Web sites in less privileged Web content zones can navigate into this zone
Description:This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48400 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Web sites in less privileged Web content zones can navigate into this zone
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2101'
State ID:oval:mil.disa.fso.ie:ste:48400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2101'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59559r1_rule
Result:Pass
Version:DTBI520-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If Prompt is selected in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur. If this policy setting is disabled, the potentially risky navigation is prevented. The Internet Explorer security feature will be on in this zone as set by the Protection from Zone Elevation feature control. If this policy setting is not configured, websites from less privileged zones can open new windows in, or navigate into, this zone. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Web sites in less privileged Web content zones can navigate into this zone' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:485
Result:true
Title:DTBI520-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Web sites in less privileged Web content zones can navigate into this zone
Description:This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48500 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Web sites in less privileged Web content zones can navigate into this zone
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2101'
State ID:oval:mil.disa.fso.ie:ste:48500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2101'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Allow binary and script behaviors must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59565r1_rule
Result:Pass
Version:DTBI575-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable this policy setting, binary and script behaviors are available. If you select "Administrator approved" in the drop-down box, only the behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager. If you do not configure this policy setting, binary and script behaviors are available. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow binary and script behaviors' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:486
Result:true
Title:DTBI575-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow binary and script behaviors
Description:This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48600 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow binary and script behaviors
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2000'
State ID:oval:mil.disa.fso.ie:ste:48600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2000'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Automatic prompting for file downloads must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59569r1_rule
Result:Pass
Version:DTBI580-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Users may accept downloads that they did not request, and those downloaded files may include malicious code. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the information bar instead of the file download dialog. Users can then click the information bar to allow the file download prompt. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Automatic prompting for file downloads' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:487
Result:true
Title:DTBI580-IE11 - Automatic prompting for file downloads must be disallowed (Restricted Sites zone)
Description:This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. If you enable this setting, users will receive a file download dialog for automatic download attempts. If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48700 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Automatic prompting for file downloads
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2200'
State ID:oval:mil.disa.fso.ie:ste:48700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2200'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Internet Explorer Processes for MIME handling must be enforced. (Reserved)

Rule ID:xccdf_mil.disa.stig_rule_SV-59573r1_rule
Result:Pass
Version:DTBI590-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:488
Result:true
Title:DTBI590-IE11 - Internet Explorer Processes for MIME handling must be enforced (Reserved)
Description:Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48800 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:48800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MIME handling must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59575r1_rule
Result:Pass
Version:DTBI592-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to the organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:502
Result:true
Title:DTBI592-IE11 - Internet Explorer Processes for MIME handling must be enforced (Explorer)
Description:Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50200 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:50200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MIME handling must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59577r1_rule
Result:Pass
Version:DTBI594-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires all file-type information provided by web servers to be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistent and properly labeled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Consistent Mime Handling -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:503
Result:true
Title:DTBI592-IE11 - Internet Explorer Processes for MIME handling must be enforced (Explorer)
Description:Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted. If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50300 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:50300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MIME sniffing must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59579r1_rule
Result:Pass
Version:DTBI595-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends you configure this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:489
Result:true
Title:DTBI595-IE11 - Internet Explorer Processes for MIME sniffing must be enforced (Reserved).
Description:MIME sniffing is the process of examining the content of a MIME file to determine its context ? whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:48900 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:48900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:48900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MIME sniffing must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59581r1_rule
Result:Pass
Version:DTBI596-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:510
Result:true
Title:DTBI596-IE11 - Internet Explorer Processes for MIME sniffing must be enforced (Explorer)
Description:MIME sniffing is the process of examining the content of a MIME file to determine its context ? whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51000 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature\Internet Explorer Processes must be Enabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:51000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MIME sniffing must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59583r1_rule
Result:Pass
Version:DTBI597-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to "Enabled", MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to an organization. Ensuring these files are consistently handled helps prevent malicious file downloads from infecting the network. This guide recommends configuring this policy as "Enabled" for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Mime Sniffing Safety Feature -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:511
Result:true
Title:DTBI597-IE11 - Internet Explorer Processes for MIME sniffing must be enforced (Explorer)
Description:MIME sniffing is the process of examining the content of a MIME file to determine its context ? whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed. MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51100 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature\Internet Explorer Processes must be Enabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:51100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MK protocol must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59585r1_rule
Result:Pass
Version:DTBI599-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends configuring this setting to "Enabled" to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:504
Result:true
Title:DTBI599-IE11 - Internet Explorer Processes for MK protocol must be enforced (Reserved).
Description:The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to enabled, blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This guide recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:50400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MK protocol must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59587r1_rule
Result:Pass
Version:DTBI600-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to "Enabled" to block the MK protocol unless it is specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:490
Result:true
Title:DTBI600-IE11 - Internet Explorer Processes for MK protocol must be enforced (Explorer)
Description:The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to enabled, blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This guide recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49000 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:49000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for MK protocol must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59589r1_rule
Result:Pass
Version:DTBI605-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information from compressed files. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to "Enabled"; blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. This guide recommends you configure this setting to "Enabled" to block the MK protocol unless specifically needed in the environment. Note: Because resources that use the MK protocol will fail when deploying this setting, ensure none of the applications use the MK protocol. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> MK Protocol Security Restriction -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:491
Result:true
Title:DTBI605-IE11 - Internet Explorer Processes for MK protocol must be enforced (IExplore)
Description:The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Because the MK Protocol is not widely used, it should be blocked wherever it is not needed. Setting this policy to enabled, blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API. Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This guide recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49100 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:49100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Zone Elevation must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59591r1_rule
Result:Pass
Version:DTBI610-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as "Enabled" in all environments. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:492
Result:true
Title:DTBI610-IE11 - Internet Explorer Processes for Zone Elevation must be enforced (Reserved)
Description:Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49200 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:49200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Zone Elevation must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59593r1_rule
Result:Pass
Version:DTBI612-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends configuring this setting as "Enabled" in all environments. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:505
Result:true
Title:DTBI612-IE11 - Internet Explorer Processes for Zone Elevation must be enforced (Explorer)
Description:Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50500 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:50500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Zone Elevation must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59595r1_rule
Result:Pass
Version:DTBI614-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection from Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as "Enabled" in all environments. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Protection From Zone Elevation -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:506
Result:true
Title:DTBI614-IE11 - Internet Explorer Processes for Zone Elevation must be enforced (IExplorer)
Description:Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers. If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50600 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:50600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Restrict File Download must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59597r1_rule
Result:Pass
Version:DTBI630-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:493
Result:true
Title:DTBI630-IE11 - File download processes - Reserved
Description:In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49300 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\ Internet Explorer\Security Features\Restrict File Download\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:49300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Restrict File Download must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59645r1_rule
Result:Pass
Version:DTBI635-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:494
Result:true
Title:DTBI635-IE11 - File download processes - Explorer
Description:In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict File Download\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:49400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Restrict File Download must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59647r1_rule
Result:Pass
Version:DTBI640-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to "Enabled", file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as "Disabled", prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as "Enabled" in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict File Download -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:495
Result:true
Title:DTBI640-IE11 - File download processes - IExplore
Description:In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on user's hard drives if they click the wrong button and accept the download. If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes. Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49500 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict File Download\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:49500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59653r1_rule
Result:Pass
Version:DTBI645-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force the user to interact with a window containing malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows, and create windows that hide other windows. Recommend configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:496
Result:true
Title:DTBI645-IE11 - Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved)
Description:Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows? title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. Recommend configuring this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49600 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:49600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59655r1_rule
Result:Pass
Version:DTBI647-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and create windows that hide other windows. This guide recommends configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:507
Result:true
Title:DTBI647-IE11 - Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer)
Description:Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows? title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This guide recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50700 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:50700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for restricting pop-up windows must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59657r1_rule
Result:Pass
Version:DTBI649-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a user to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user, or which hide other windows' title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and create windows that hide other windows. This guide recommends configuring this setting to "Enabled" to help prevent malicious websites from controlling the Internet Explorer windows or fooling users into clicking on the wrong window. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Scripted Window Security Restrictions -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:508
Result:true
Title:DTBI649-IE11 - Internet Explorer Processes for restricting pop-up windows must be enforced (IExplorer)
Description:Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows? title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows. This guide recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50800 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:50800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59663r1_rule
Result:Pass
Version:DTBI650-IE11
Identities:CCI-001687 (NIST SP 800-53: SC-18 (2); NIST SP 800-53A: SC-18 (2).1 (ii); NIST SP 800-53 Rev 4: SC-18 (2))
Description: This policy setting allows you to manage whether .NET Framework-reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will execute unsigned managed components. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components not signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:497
Result:true
Title:DTBI650-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run .NET Framework-reliant components not signed with Authenticode
Description:This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run .NET Framework-reliant components not signed with Authenticode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2004'
State ID:oval:mil.disa.fso.ie:ste:49700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2004'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

.NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59665r1_rule
Result:Pass
Version:DTBI655-IE11
Identities:CCI-001687 (NIST SP 800-53: SC-18 (2); NIST SP 800-53A: SC-18 (2).1 (ii); NIST SP 800-53 Rev 4: SC-18 (2))
Description: This policy setting allows you to manage whether .NET Framework-reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious content hosted on a website to take advantage of these components. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will execute signed managed components. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Run .NET Framework-reliant components signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:498
Result:true
Title:DTBI655-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run .NET Framework-reliant components signed with Authenticode
Description:This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Run .NET Framework-reliant components signed with Authenticode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2001'
State ID:oval:mil.disa.fso.ie:ste:49800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2001'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Scripting of Java applets must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59667r1_rule
Result:Pass
Version:DTBI670-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. If you select "Prompt" in the drop-down box, users are queried to choose whether to allow scripts to access applets. If you disable this policy setting, scripts are prevented from accessing applets. If you do not configure this policy setting, scripts can access applets automatically without user intervention. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Scripting of Java applets' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:499
Result:true
Title:DTBI670-IE11 - Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Scripting of Java applets
Description:This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:49900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Scripting of Java applets
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:49900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1402'
State ID:oval:mil.disa.fso.ie:ste:49900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1402'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Crash Detection management must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59677r1_rule
Result:Pass
Version:DTBI715-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: The 'Turn off Crash Detection' policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from the computer's memory. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier, where Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off Crash Detection' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:509
Result:true
Title:DTBI715-IE11 - Computer Configuration\Network\Internet Explorer\Turn Off Crash Detection
Description:The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:50900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Turn Off Crash Detection
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:50900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Restrictions'
  • name must be equal to 'NoCrashDetection'
State ID:oval:mil.disa.fso.ie:ste:50900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Restrictions'
  • name equals 'NoCrashDetection'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Managing SmartScreen Filter use must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59685r3_rule
Result:Pass
Version:DTBI740-IE11
Identities:CCI-001166 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (i); NIST SP 800-53 Rev 4: SC-18 (1))
Description: This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection via visiting malicious websites. This policy setting allows users to enable the SmartScreen Filter, which will warn if the website being visited is known for fraudulent attempts to gather personal information through 'phishing' or is known to host malware. If you enable this setting the user will not be prompted to enable the SmartScreen Filter. It must be specified which mode the SmartScreen Filter uses: On or Off. If the feature is On, all website addresses not contained on the filters allow list, will be sent automatically to Microsoft without prompting the user. If this feature is set to Off, the feature will not run. If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on SmartScreen Filter during the first-run experience. false
Fix Text:If the system is on the SIPRNet, this requirement is NA.

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent Managing SmartScreen Filter" to "Enabled", and select "On" from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:514
Result:true
Title:DTBI740-IE11 - Turn Off Managing SmartScreen Filter
Description:This policy setting allows the user to enable the SmartScreen Filter, which will warn if the Web site being visited is known for fraudulent attempts to gather personal information through 'phishing,' or is known to host malware.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Prevent Managing SmartScreen Filter
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\PhishingFilter'
  • name must be equal to 'EnabledV9'
State ID:oval:mil.disa.fso.ie:ste:51400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\PhishingFilter'
  • name equals 'EnabledV9'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Browser must retain history on exit.

Rule ID:xccdf_mil.disa.stig_rule_SV-59695r1_rule
Result:Pass
Version:DTBI760-IE11
Identities:CCI-000169 (NIST SP 800-53: AU-12 a; NIST SP 800-53A: AU-12.1 (ii); NIST SP 800-53 Rev 4: AU-12 a)
Description: Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious websites and files that could later be used for anti-virus and Intrusion Detection System (IDS) signatures. Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Allow deleting browsing history on exit' to 'Disabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:516
Result:true
Title:DTBI760-IE11 - Configure Delete Browsing History on exit
Description:Delete Browsing History on exit automatically deletes specified items when the last browser windows closes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51600 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Delete Browsing History\Configure Delete Browsing History on exit
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Privacy'
  • name must be equal to 'ClearBrowsingHistoryOnExit'
State ID:oval:mil.disa.fso.ie:ste:51600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Privacy'
  • name equals 'ClearBrowsingHistoryOnExit'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Deleting websites that the user has visited must be disallowed.

Rule ID:xccdf_mil.disa.stig_rule_SV-59707r1_rule
Result:Pass
Version:DTBI770-IE11
Identities:CCI-000169 (NIST SP 800-53: AU-12 a; NIST SP 800-53A: AU-12.1 (ii); NIST SP 800-53 Rev 4: AU-12 a)
Description: This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks "Delete". If you disable this policy setting, websites that the user has visited will be deleted when the user clicks "Delete". If you do not configure this policy setting, the user will be able to select whether to delete or preserve websites the user visited when the user clicks "Delete". false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Delete Browsing History -> 'Prevent Deleting Web sites that the User has Visited' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:517
Result:true
Title:DTBI770-IE11 - Prevent Deleting Web sites that the User has Visited
Description:This policy setting prevents users from deleting the history of webs sites the user has visited.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Delete Browsing History\Prevent Deleting Web sites that the User has Visited
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Privacy'
  • name must be equal to 'CleanHistory'
State ID:oval:mil.disa.fso.ie:ste:51700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Privacy'
  • name equals 'CleanHistory'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

InPrivate Browsing must be disallowed.

Rule ID:xccdf_mil.disa.stig_rule_SV-59713r1_rule
Result:Pass
Version:DTBI780-IE11
Identities:CCI-000166 (NIST SP 800-53: AU-10; NIST SP 800-53A: AU-10.1; NIST SP 800-53 Rev 4: AU-10)
Description: InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The InPrivate Browsing feature in Internet Explorer makes browser privacy easy by not storing history, cookies, temporary Internet files, or other data. If you enable this policy setting, InPrivate Browsing will be disabled. If you disable this policy setting, InPrivate Browsing will be available for use. If you do not configure this setting, InPrivate Browsing can be turned on or off through the registry. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Privacy -> 'Turn off InPrivate Browsing' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:518
Result:true
Title:DTBI780-IE11 - Turn off InPrivate Browsing
Description:This policy setting allows you to disable the InPrivate Browsing feature.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\InPrivate\Turn off InPrivate Browsing
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Privacy'
  • name must be equal to 'EnableInPrivateBrowsing'
State ID:oval:mil.disa.fso.ie:ste:51800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Privacy'
  • name equals 'EnableInPrivateBrowsing'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59715r1_rule
Result:Pass
Version:DTBI800-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser control is allowed. If you disable this policy setting, script access to the WebBrowser control is not allowed. If you do not configure this policy setting, script access to the WebBrowser control can be enabled or disabled by the user. By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:519
Result:true
Title:DTBI800-IE11 - Allow scripting of Internet Explorer web browser control
Description:This policy setting controls whether a page may control embedded WebBrowser Controls via script
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:51900 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow scripting of Internet Explorer web browser control
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:51900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1206'
State ID:oval:mil.disa.fso.ie:ste:51900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1206'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

When uploading files to a server, the local directory path must be excluded (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59719r1_rule
Result:Pass
Version:DTBI810-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Include local path when user is uploading files to a server' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:520
Result:true
Title:DTBI810-IE11 - Include local directory path when uploading files to a server
Description:This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52000 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Include local directory path when uploading files to a server
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '160A'
State ID:oval:mil.disa.fso.ie:ste:52000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '160A'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Internet Explorer Processes for Notification Bars must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59723r1_rule
Result:Pass
Version:DTBI815-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:541
Result:true
Title:DTBI815-IE11 - Notification Bar Process - Reserved
Description:This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:54100 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Notification Bar\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:54100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:54100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Security Warning for unsafe files must be set to prompt (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59725r1_rule
Result:Pass
Version:DTBI820-IE11
Identities:CCI-001274 (NIST SP 800-53: SI-4 (12); NIST SP 800-53A: SI-4 (12).1 (ii); NIST SP 800-53 Rev 4: SI-4 (12))
Description: This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to "Enable", these files open without a security warning. If you set the drop-down box to " Prompt", a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Show security warning for potentially unsafe files' to 'Enabled', and select 'Prompt' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:521
Result:true
Title:DTBI820-IE11 - Launching programs and unsafe files
Description:This policy setting controls whether or not the 'Open File - Security Warning' prompt is shown when launching executables or other unsafe files.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Launching programs and unsafe files
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1806'
State ID:oval:mil.disa.fso.ie:ste:52100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1806'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Internet Explorer Processes for Notification Bars must be enforced (Explorer).

Rule ID:xccdf_mil.disa.stig_rule_SV-59727r1_rule
Result:Pass
Version:DTBI825-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:542
Result:true
Title:DTBI825-IE11 - Notification Bar Processes - Explorer
Description:This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:54200 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Notification Bar\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:54200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND'
  • name must be equal to 'explorer.exe'
State ID:oval:mil.disa.fso.ie:ste:54200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND'
  • name equals 'explorer.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

ActiveX controls without prompt property must be used in approved domains only (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59729r1_rule
Result:Pass
Version:DTBI830-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow only approved domains to use ActiveX controls without prompt' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:522
Result:true
Title:DTBI830-IE11 - Only allow approved domains to use ActiveX controls without prompt
Description:This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Only allow approved domains to use ActiveX controls without prompt
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '120B'
State ID:oval:mil.disa.fso.ie:ste:52200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '120b'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Internet Explorer Processes for Notification Bars must be enforced (iexplore).

Rule ID:xccdf_mil.disa.stig_rule_SV-59735r1_rule
Result:Pass
Version:DTBI835-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether the Notification Bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification Bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Notification Bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification Bar will be displayed for Internet Explorer processes. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features-> Notification Bar-> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:543
Result:true
Title:DTBI835-IE11 - Notification Bar Processes - IExplorer
Description:This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes. If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes. If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:54300 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Notification Bar\Internet Explorer Processes
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:54300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND'
  • name must be equal to 'iexplore.exe'
State ID:oval:mil.disa.fso.ie:ste:54300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND'
  • name equals 'iexplore.exe'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Cross-Site Scripting Filter must be enforced (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59745r1_rule
Result:Pass
Version:DTBI840-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Turn on Cross-Site Scripting Filter' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:523
Result:true
Title:DTBI840-IE11 - Cross-Site Scripting Filter - Internet
Description:The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into Web sites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52300 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Turn on Cross-Site Scripting (XSS) Filter must be Enabled and Enable selected
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '1409'
State ID:oval:mil.disa.fso.ie:ste:52300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '1409'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Scripting of Internet Explorer WebBrowser Control must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59749r1_rule
Result:Pass
Version:DTBI850-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting controls whether a page may control embedded WebBrowser Control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you enable this policy setting, script access to the WebBrowser Control is allowed. If you disable this policy setting, script access to the WebBrowser Control is not allowed. If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user. By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet Zones. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow scripting of Internet Explorer WebBrowser controls' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:524
Result:true
Title:DTBI850-IE11 - Allow scripting of Internet Explorer web browser control
Description:This policy setting controls whether a page may control embedded WebBrowser Controls via script
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52400 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow scripting of Internet Explorer web browser control
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1206'
State ID:oval:mil.disa.fso.ie:ste:52400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1206'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

When uploading files to a server, the local directory path must be excluded (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59751r1_rule
Result:Pass
Version:DTBI860-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form. By default, path information will be sent. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Include local path when user is uploading files to a server' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:525
Result:true
Title:DTBI860-IE11 - Include local directory path when uploading files to a server
Description:This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52500 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Include local directory path when uploading files to a server
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '160A'
State ID:oval:mil.disa.fso.ie:ste:52500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '160A'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Security Warning for unsafe files must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59755r1_rule
Result:Pass
Version:DTBI870-IE11
Identities:CCI-001274 (NIST SP 800-53: SI-4 (12); NIST SP 800-53A: SI-4 (12).1 (ii); NIST SP 800-53 Rev 4: SI-4 (12))
Description: This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to "Enable", these files open without a security warning. If you set the drop-down box to "Prompt", a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Show security warning for potentially unsafe files' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:526
Result:true
Title:DTBI870-IE11 - Launching programs and unsafe files
Description:This policy setting controls whether or not the 'Open File - Security Warning' prompt is shown when launching executables or other unsafe files.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52600 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Launching programs and unsafe files
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1806'
State ID:oval:mil.disa.fso.ie:ste:52600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1806'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59759r1_rule
Result:Pass
Version:DTBI880-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable the setting for the zone, malicious ActiveX controls could be executed without the user's knowledge. Disabling this setting would allow the possibility for malicious ActiveX controls to be executed from non-approved domains within this zone without the user's knowledge. Enabling this setting enforces the default value and prohibits the user from changing the value. Websites should be moved into another zone if permissions need to be changed. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Allow only approved domains to use ActiveX controls without prompt' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:527
Result:true
Title:DTBI880-IE11 - Only allow approved domains to use ActiveX controls without prompt
Description:This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52700 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Only allow approved domains to use ActiveX controls without prompt
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '120B'
State ID:oval:mil.disa.fso.ie:ste:52700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '120b'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Cross-Site Scripting Filter property must be enforced (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59761r1_rule
Result:Pass
Version:DTBI890-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: The Cross-Site Scripting Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into websites in this zone. If you enable this policy setting, the XSS Filter will be enabled for sites in this zone, and the XSS Filter will attempt to block cross-site script injections. If you disable this policy setting, the XSS Filter will be disabled for sites in this zone, and Internet Explorer will permit cross-site script injections. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone -> 'Turn on Cross-Site Scripting Filter' to 'Enabled', and select 'Enable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:528
Result:true
Title:DTBI890-IE11 - Turn on Cross-Site Scripting (XSS) Filter
Description:This policy setting controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52800 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Turn on Cross-Site Scripting (XSS) Filter
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1409'
State ID:oval:mil.disa.fso.ie:ste:52800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1409'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved).

Rule ID:xccdf_mil.disa.stig_rule_SV-59763r1_rule
Result:Pass
Version:DTBI900-IE11
Identities:CCI-001695 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Restrict ActiveX Install -> 'Internet Explorer Processes' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:529
Result:true
Title:DTBI900-IE11 - ActiveX Install - Reserved
Description:Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. If you enable this policy setting, prompts for ActiveX control installations will be blocked for Internet Explorer processes. If you disable this policy setting, prompts for ActiveX control installations will not be blocked and these prompts will be displayed to users. If you do not configure this policy setting, the user?s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:52900 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install\Internet Explorer Processes must be Enabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:52900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'
  • name must be equal to '(Reserved)'
State ID:oval:mil.disa.fso.ie:ste:52900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'
  • name equals '(Reserved)'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals '1'
  • windows_view equals '64_bit'

Status bar updates via script must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59769r1_rule
Result:Pass
Version:DTBI910-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause them to perform an undesirable action. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Allow updates to status bar via script' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:530
Result:true
Title:DTBI910-IE11 - Status bar updates via script must be disallowed (Internet zone)
Description:This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause him to perform an undesirable action. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53000 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone Allow status bar updates via script must be Enabled and Disable selected
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53000 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2103'
State ID:oval:mil.disa.fso.ie:ste:53000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2103'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

.NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59773r1_rule
Result:Pass
Version:DTBI920-IE11
Identities:CCI-001687 (NIST SP 800-53: SC-18 (2); NIST SP 800-53A: SC-18 (2).1 (ii); NIST SP 800-53 Rev 4: SC-18 (2))
Description: Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible. This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components. If you disable this policy setting, Internet Explorer will not execute unsigned managed components. If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components not signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:531
Result:true
Title:DTBI920-IE11 - Run .NET Framework-reliant components not signed with Authenticode
Description:This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53100 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Run .NET Framework-reliant components not signed with Authenticode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2004'
State ID:oval:mil.disa.fso.ie:ste:53100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2004'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

.NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59787r1_rule
Result:Pass
Version:DTBI930-IE11
Identities:CCI-001687 (NIST SP 800-53: SC-18 (2); NIST SP 800-53A: SC-18 (2).1 (ii); NIST SP 800-53 Rev 4: SC-18 (2))
Description: It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link. If you enable this policy setting, Internet Explorer will execute signed managed components. If you select "Prompt" in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components. If you disable this policy setting, Internet Explorer will not execute signed managed components. If you do not configure this policy setting, Internet Explorer will not execute signed managed components. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone 'Run .NET Framework-reliant components signed with Authenticode' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:532
Result:true
Title:DTBI930-IE11 - Run .NET Framework-reliant components signed with Authenticode
Description:This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53200 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Run .NET Framework-reliant components signed with Authenticode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2001'
State ID:oval:mil.disa.fso.ie:ste:53200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2001'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Scriptlets must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59793r1_rule
Result:Pass
Version:DTBI940-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow Scriptlets' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:533
Result:true
Title:DTBI940-IE11 - Allow Scriptlets
Description:This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53300 (registry_test)
Result:true
Title:Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow Scriptlets
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '1209'
State ID:oval:mil.disa.fso.ie:ste:53300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '1209'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Status bar updates via script must be disallowed (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59805r1_rule
Result:Pass
Version:DTBI950-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. If you disable this policy setting, script is not allowed to update the status bar. If you do not configure this policy setting, status bar updates via scripts will be disabled. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Allow updates to status bar via script' to 'Enabled', and select 'Disable' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:534
Result:true
Title:DTBI950-IE11 - Status bar updates via script must be disallowed (Restricted Site zone)
Description:A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage whether script is allowed to update the status bar within the zone.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:53400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone Allow status bar updates via script must be Enabled and Disabled selected
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:53400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2103'
State ID:oval:mil.disa.fso.ie:ste:53400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2103'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

When Enhanced Protected Mode is enabled, ActiveX controls must be disallowed to run in Protected Mode.

Rule ID:xccdf_mil.disa.stig_rule_SV-59841r2_rule
Result:Pass
Version:DTBI985-IE11
Identities:CCI-001687 (NIST SP 800-53: SC-18 (2); NIST SP 800-53A: SC-18 (2).1 (ii); NIST SP 800-53 Rev 4: SC-18 (2))
Description: This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode. Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode. If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode. false
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page 'Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:556
Result:true
Title:DTBI985-IE11 - ActiveX controls in enhanced protected mode
Description:This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode. Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode. If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:55600 (registry_test)
Result:true
Title:Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Advanced Page/Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:55600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main'
  • name must be equal to 'DisableEPMCompat'
State ID:oval:mil.disa.fso.ie:ste:55600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main'
  • name equals 'DisableEPMCompat'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Dragging of content from different domains across windows must be disallowed (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-59847r1_rule
Result:Pass
Version:DTBI990-IE11
Identities:CCI-001414 (NIST SP 800-53: AC-4; NIST SP 800-53A: AC-4.1 (iii); NIST SP 800-53 Rev 4: AC-4)
Description: This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog box. false ECSC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Security Page-> Internet Zone 'Enable dragging of content from different domains across windows' to 'Enabled', and select 'Disabled' from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:547
Result:true
Title:DTBI990-IE11 - Content from different domains across windows - Internet zone
Description:This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy setting, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting. If you disable this policy setting, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting. If you do not configure this policy setting, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:54700 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Enable dragging of content from different domains across windows
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:54700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2709'
State ID:oval:mil.disa.fso.ie:ste:54700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2709'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Enhanced Protected Mode functionality must be enforced.

Rule ID:xccdf_mil.disa.stig_rule_SV-59853r3_rule
Result:Pass
Version:DTBI995-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode. If you disable this policy setting, Enhanced Protected Mode will be turned off. Any zone that has Protected Mode enabled will use the version of Protected Mode introduced in Internet Explorer 7 for Windows Vista. If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the "Advanced" tab of the Internet Options dialog box. false
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel-> Advanced Page 'Turn on Enhanced Protected Mode' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:551
Result:true
Title:DTBI995-IE11 - Enhanced Protected Mode
Description:Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system. If you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode. If you disable this policy setting, Enhanced Protected Mode will be turned off. Any zone that has Protected Mode enabled will use the version of Protected Mode introduced in Internet Explorer 7 for Windows Vista. If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:55100 (registry_test)
Result:true
Title:Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Advanced Page/Turn on Enhanced Protected Mode
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:55100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main'
  • name must be equal to 'Isolation'
State ID:oval:mil.disa.fso.ie:ste:55100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be equal to 'PMEM'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main'
  • name equals 'Isolation'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_sz'
  • value equals 'PMEM'
  • windows_view equals '64_bit'

The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on.

Rule ID:xccdf_mil.disa.stig_rule_SV-59861r2_rule
Result:Pass
Version:DTBI356-IE11
Identities:CCI-001084 (NIST SP 800-53: SC-3; NIST SP 800-53A: SC-3.1 (ii); NIST SP 800-53 Rev 4: SC-3)
Description: This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used. If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows. If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default. false
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Advanced Page 'Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows' to 'Enabled'.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:564
Result:true
Title:DTBI356-IE11 - The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on
Description:This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used.If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:56400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:56400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Main'
  • name must be equal to 'Isolation64Bit'
State ID:oval:mil.disa.fso.ie:ste:56400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Main'
  • name equals 'Isolation64Bit'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Anti-Malware programs against ActiveX controls must be run for the Internet zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59863r1_rule
Result:Pass
Version:DTBI1046-IE11
Identities:CCI-001662 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (ii); NIST SP 800-53 Rev 4: SC-18 (1))
Description: This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Internet Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:565
Result:true
Title:DTBI1046-IE11 - Antimalware programs against ActiveX controls must be run for the Internet zone
Description:This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:56500 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone Don't run antimalware programs against ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:56500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '270C'
State ID:oval:mil.disa.fso.ie:ste:56500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '270C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Anti-Malware programs against ActiveX controls must be run for the Intranet zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59865r1_rule
Result:Pass
Version:DTBI062-IE11
Identities:CCI-001662 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (ii); NIST SP 800-53 Rev 4: SC-18 (1))
Description: This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Intranet Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:566
Result:true
Title:DTBI062-IE11 - Antimalware programs against ActiveX controls must be run for the Intranet zone
Description:This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings..
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:56600 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone Don't run antimalware programs against ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:56600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1'
  • name must be equal to '270C'
State ID:oval:mil.disa.fso.ie:ste:56600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1'
  • name equals '270C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Anti-Malware programs against ActiveX controls must be run for the Local Machine zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59869r1_rule
Result:Pass
Version:DTBI426-IE11
Identities:CCI-001662 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (ii); NIST SP 800-53 Rev 4: SC-18 (1))
Description: This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Local Machine Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:567
Result:true
Title:DTBI426-IE11 - Antimalware programs against ActiveX controls must be run for the Local Machine zone
Description:This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:56700 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone Don't run antimalware programs against ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:56700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0'
  • name must be equal to '270C'
State ID:oval:mil.disa.fso.ie:ste:56700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0'
  • name equals '270C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Anti-Malware programs against ActiveX controls must be run for the Restricted Sites zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59871r1_rule
Result:Pass
Version:DTBI1051-IE11
Identities:CCI-001662 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (ii); NIST SP 800-53 Rev 4: SC-18 (1))
Description: This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Restricted Sites Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:568
Result:true
Title:DTBI1051-IE11 - Antimalware programs against ActiveX controls must be run for the Restricted Sites zone
Description:This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:56800 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone Don't run antimalware programs against ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:56800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '270C'
State ID:oval:mil.disa.fso.ie:ste:56800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '270C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Anti-Malware programs against ActiveX controls must be run for the Trusted Sites zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-59875r1_rule
Result:Pass
Version:DTBI092-IE11
Identities:CCI-001662 (NIST SP 800-53: SC-18 (1); NIST SP 800-53A: SC-18 (1).1 (ii); NIST SP 800-53 Rev 4: SC-18 (1))
Description: This policy setting determines whether Internet Explorer runs Anti-Malware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you disable this policy setting, Internet Explorer always checks with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. If you don't configure this policy setting, Internet Explorer won't check with your Anti-Malware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings. false DCMC-1
Fix Text:Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer-> Internet Control Panel -> Security Page -> Trusted Sites Zone 'Don't run antimalware programs against ActiveX controls' to 'Enabled' and select 'Disable' in the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:569
Result:true
Title:DTBI092-IE11 - Antimalware programs against ActiveX controls must be run for the Trusted Sites zone
Description:This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:56900 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone Don't run antimalware programs against ActiveX controls
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:56900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
  • name must be equal to '270C'
State ID:oval:mil.disa.fso.ie:ste:56900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
  • name equals '270C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Prevent bypassing SmartScreen Filter warnings must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79201r2_rule
Result:Pass
Version:DTBI1060-IE11
Identities:CCI-001242 (NIST SP 800-53: SI-3 c; NIST SP 800-53A: SI-3.1 (vi); NIST SP 800-53 Rev 4: SI-3 c 1)
Description: This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. false
Fix Text:If the system is on the SIPRNet, this requirement is NA.

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings” to ”Enabled”.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:578
Result:true
Title:DTBI1060-IE11-Managing SmartScreen Filter Warnings
Description:This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter prevents the user from browsing to or downloading from sites that are known to host malicious content. SmartScreen Filter also prevents the execution of files that are known to be malicious. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57800 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\PreventOverride is a REG_DWORD equal to 1
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\PhishingFilter'
  • name must be equal to 'PreventOverride'
State ID:oval:mil.disa.fso.ie:ste:57800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\PhishingFilter'
  • name equals 'PreventOverride'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79203r2_rule
Result:Pass
Version:DTBI1065-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the internet. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings. false
Fix Text:If the system is on the SIPRNet, this requirement is NA.

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet” to ”Enabled”.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:572
Result:true
Title:DTBI1065-IE11-Managing SmartScreen Filter Warnings
Description:This policy setting determines whether the user can bypass warnings from SmartScreen Filter. SmartScreen Filter warns the user about executable files that Internet Explorer users do not commonly download from the internet. If you enable this policy setting, SmartScreen Filter warnings block the user. If you disable or do not configure this policy setting, the user can bypass SmartScreen Filter warnings.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57200 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter\PreventOverrideAppRepUnknown is a REG_DWORD equal to 1
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57200 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\PhishingFilter'
  • name must be equal to 'PreventOverrideAppRepUnknown'
State ID:oval:mil.disa.fso.ie:ste:57200 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\PhishingFilter'
  • name equals 'PreventOverrideAppRepUnknown'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Prevent per-user installation of ActiveX controls must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79205r1_rule
Result:Pass
Version:DTBI1070-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> ”Prevent per-user installation of ActiveX controls” to ”Enabled”.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:574
Result:true
Title:DTBI1070-IE11-Per-User ActiveX Controls
Description:This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57400 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX\BlockNonAdminActiveXInstall is a REG_DWORD equal to 1
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\Security\ActiveX'
  • name must be equal to 'BlockNonAdminActiveXInstall'
State ID:oval:mil.disa.fso.ie:ste:57400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\Security\ActiveX'
  • name equals 'BlockNonAdminActiveXInstall'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Prevent ignoring certificate errors option must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79207r2_rule
Result:Pass
Version:DTBI1075-IE11
Identities:CCI-002470 (NIST SP 800-53 Rev 4: SC-23 (5))
Description: This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as “expired”, “revoked”, or “name mismatch” errors) in Internet Explorer. If you enable this policy setting, the user cannot continue browsing. If you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> ”Prevent ignoring certificate errors” to ”Enabled”.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:575
Result:true
Title:DTBI1075-IE11-Prevent Ignoring Certificate Errors
Description:This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as "expired", "revoked", or "name mismatch" errors) in Internet Explorer. If you enable this policy setting, the user cannot continue browsing. If you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57500 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\PreventIgnoreCertErrors is a REG_DWORD equal to 1
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'PreventIgnoreCertErrors'
State ID:oval:mil.disa.fso.ie:ste:57500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'PreventIgnoreCertErrors'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Turn on SmartScreen Filter scan option for the Internet Zone must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79209r1_rule
Result:Pass
Version:DTBI1080-IE11
Identities:CCI-001242 (NIST SP 800-53: SI-3 c; NIST SP 800-53A: SI-3.1 (vi); NIST SP 800-53 Rev 4: SI-3 c 1)
Description: This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> ”Turn on SmartScreen Filter scan” to ”Enabled”, and select ”Enable” from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:577
Result:true
Title:DTBI1080-IE11-Managing SmartScreen Filter-Internet Zone
Description:This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57700 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2301 is a REG_DWORD equal to 0
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '2301'
State ID:oval:mil.disa.fso.ie:ste:57700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '2301'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Turn on SmartScreen Filter scan option for the Restricted Sites Zone must be enabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79211r1_rule
Result:Pass
Version:DTBI1085-IE11
Identities:CCI-001242 (NIST SP 800-53: SI-3 c; NIST SP 800-53A: SI-3.1 (vi); NIST SP 800-53 Rev 4: SI-3 c 1)
Description: This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> ”Turn on SmartScreen Filter scan” to ”Enabled”, and select ”Enable” from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:576
Result:true
Title:DTBI1085-IE11-Managing SmartScreen Filter - Restricted Sites Zone
Description:This policy setting controls whether SmartScreen Filter scans pages in this zone for malicious content. If you enable this policy setting, SmartScreen Filter scans pages in this zone for malicious content. If you disable this policy setting, SmartScreen Filter does not scan pages in this zone for malicious content. If you do not configure this policy setting, the user can choose whether SmartScreen Filter scans pages in this zone for malicious content.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57600 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2301 is a REG_DWORD equal to 0
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '2301'
State ID:oval:mil.disa.fso.ie:ste:57600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '2301'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

The Initialize and script ActiveX controls not marked as safe must be disallowed (Intranet Zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-79213r1_rule
Result:Pass
Version:DTBI1090-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Intranet Zone >> ”Initialize and script ActiveX controls not marked as safe” to ”Enabled”, and select ”Disable” from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:579
Result:true
Title:DTBI1090-IE11-Initialize and script ActiveX-Intranet Zone
Description:ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57900 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201 is a REG_DWORD equal to 3
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1'
  • name must be equal to '1201'
State ID:oval:mil.disa.fso.ie:ste:57900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1'
  • name equals '1201'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

The Initialize and script ActiveX controls not marked as safe must be disallowed (Trusted Sites Zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-79215r1_rule
Result:Pass
Version:DTBI1095-IE11
Identities:CCI-001170 (NIST SP 800-53: SC-18 (4); NIST SP 800-53A: SC-18 (4).1 (iii) (iv); NIST SP 800-53 Rev 4: SC-18 (4))
Description: ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Trusted Sites Zone >> ”Initialize and script ActiveX controls not marked as safe” to ”Enabled”, and select ”Disable” from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:573
Result:true
Title:DTBI1095-IE11-Initialize and script ActiveX-Trusted Sites Zone
Description:ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. This increases the risk of malicious code being loaded and executed by the browser. If you enable this policy setting, ActiveX controls are run, loaded with parameters and scripted without setting object safety for untrusted data or scripts. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. This setting is not recommended, except for secure and administered zones.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:57300 (registry_test)
Result:true
Title:HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1201 is a REG_DWORD equal to 3
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:57300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
  • name must be equal to '1201'
State ID:oval:mil.disa.fso.ie:ste:57300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2'
  • name equals '1201'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'

Allow Fallback to SSL 3.0 (Internet Explorer) must be disabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-79219r3_rule
Result:Pass
Version:DTBI1100-IE11
Identities:CCI-002450 (NIST SP 800-53 Rev 4: SC-13)
Description: This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by blocking an insecure fallback to SSL when TLS 1.0 or greater fails. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> "Allow fallback to SSL 3.0 (Internet Explorer)" to "Enabled", and select "No Sites" from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:581
Result:true
Title:Allow Fallback to SSL 3.0 (Internet Explorer) must be disabled.
Description:This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser by blocking an insecure fallback to SSL when TLS 1.0 or greater fails.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58100 (registry_test)
Result:true
Title:'Allow Fallback to SSL 3.0 (Internet Explorer)' is set to 'Enabled' with 'Allow insecure fallback for:' set to 'No Sites'
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name must be equal to 'EnableSSL3Fallback'
State ID:oval:mil.disa.fso.ie:ste:58100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings'
  • name equals 'EnableSSL3Fallback'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Run once selection for running outdated ActiveX controls must be disabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-87395r2_rule
Result:Pass
Version:DTBI1105-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls. false
Fix Text:In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, set "Remove the Run this time button for outdated ActiveX controls in IE" to "Enabled".
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:585
Result:true
Title:DTBI1105-IE11-Run once selection for running outdated ActiveX controls must be disabled
Description:Run once selection for running outdated ActiveX controls must be disabled.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58500 (registry_test)
Result:true
Title:Check if HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\RunThisTimeEnabled is set to 0
Check Existence:All collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58500 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext'
  • name must be equal to 'RunThisTimeEnabled'
State ID:oval:mil.disa.fso.ie:ste:58500 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '0'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext'
  • name equals 'RunThisTimeEnabled'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '0'
  • windows_view equals '64_bit'

Enabling outdated ActiveX controls for Internet Explorer must be blocked.

Rule ID:xccdf_mil.disa.stig_rule_SV-87397r2_rule
Result:Pass
Version:DTBI1110-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This feature keeps ActiveX controls up to date and helps make them safer to use in Internet Explorer. Many ActiveX controls are not automatically updated as new versions are released. It is very important to keep ActiveX controls up to date because malicious or compromised webpages can target security flaws in out-of-date ActiveX controls. false
Fix Text:In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Security Features >> Add-on Management, set "Turn off blocking of outdated ActiveX controls for Internet Explorer" to "Disabled".
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:586
Result:true
Title:DTBI1110-IE11-Enabling outdated ActiveX controls for Internet Explorer must be blocked
Description:Enabling outdated ActiveX controls for Internet Explorer must be blocked.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58600 (registry_test)
Result:true
Title:Check if HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\VersionCheckEnabled is set to 1
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58600 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows\CurrentVersion\Policies\Ext'
  • name must be equal to 'VersionCheckEnabled'
State ID:oval:mil.disa.fso.ie:ste:58600 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows\CurrentVersion\Policies\Ext'
  • name equals 'VersionCheckEnabled'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'

Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Internet Zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-87399r2_rule
Result:Pass
Version:DTBI1115-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy setting, users will not be able to run the TDC ActiveX control from all sites in the specified zone. false
Fix Text:In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Pane >> Security Page >> Internet Zone, set the "Allow only approved domains to use the TDC ActiveX control" to “Enabled”.

In the Options window, select "Enable" from the “Only allow approved domains to use the TDC ActiveX control" drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:583
Result:true
Title:DTBI1115-IE11 - Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow only approved domains to use the TDC ActiveX control
Description:This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Resticted Sites security zones. If you enable this policy setting, users will not be able to run the TDC ActiveX control from all sites in the specified zones.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58300 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Allow only approved domains to use the TDC ActiveX control
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58300 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '120c'
State ID:oval:mil.disa.fso.ie:ste:58300 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '120c'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58700 (registry_test)
Result:true
Title:The OS Version is equal to or greater than 6.3
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentVersion'
State ID:oval:mil.disa.fso.ie:ste:58700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '6.3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentVersion'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '6.3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58701 (registry_test)
Result:true
Title:The OS Build is equal to or greater than 14393
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58701 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentBuildNumber'
State ID:oval:mil.disa.fso.ie:ste:58701 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '14393'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentBuildNumber'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '14393'
  • windows_view equals '64_bit'

Use of the Tabular Data Control (TDC) ActiveX control must be disabled for the Restricted Sites Zone.

Rule ID:xccdf_mil.disa.stig_rule_SV-87401r2_rule
Result:Pass
Version:DTBI1120-IE11
Identities:CCI-000381 (NIST SP 800-53: CM-7; NIST SP 800-53A: CM-7.1 (ii); NIST SP 800-53 Rev 4: CM-7 a)
Description: This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Restricted Sites security zones. If you enable this policy setting, users won’t be able to run the TDC ActiveX control from all sites in the specified zone. false
Fix Text:In the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone, set the "Allow only approved domains to use the TDC ActiveX control" to “Enabled”.

In the Options windows, select "Enable" from the “Only allow approved domains to use the TDC ActiveX control" drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:584
Result:true
Title:DTBI1120-IE11 - Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow only approved domains to use the TDC ActiveX control
Description:This policy setting determines whether users can run the Tabular Data Control (TDC) ActiveX control, based on security zone. By default, the TDC ActiveX Control is disabled in the Internet and Resticted Sites security zones. If you enable this policy setting, users will not be able to run the TDC ActiveX control from all sites in the specified zones.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58400 (registry_test)
Result:true
Title:Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Allow only approved domains to use the TDC ActiveX control
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58400 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '120c'
State ID:oval:mil.disa.fso.ie:ste:58400 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • for all value, the following must be true:
    • value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '120c'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58700 (registry_test)
Result:true
Title:The OS Version is equal to or greater than 6.3
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentVersion'
State ID:oval:mil.disa.fso.ie:ste:58700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '6.3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentVersion'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '6.3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58701 (registry_test)
Result:true
Title:The OS Build is equal to or greater than 14393
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58701 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentBuildNumber'
State ID:oval:mil.disa.fso.ie:ste:58701 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '14393'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentBuildNumber'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '14393'
  • windows_view equals '64_bit'

VBScript must not be allowed to run in Internet Explorer (Internet zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-89849r1_rule
Result:Pass
Version:DTBI1125-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down box, users are asked to choose whether to allow VBScript to run. By selecting "Disable" in the drop-down box, VBScript is prevented from running. If this policy setting is not configured or disabled, VBScript will run without user intervention. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Internet Zone >> "Allow VBScript to run in Internet Explorer" to "Enabled" and select "Disable" from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:588
Result:true
Title:VBScript must not be allowed to run in Internet Explorer (Internet Zone)
Description:This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer. If you selected Enable in the drop-down box VBScript can run without user intervention. If you selected Prompt in the drop-down box users are asked to choose whether to allow VBScript to run. If you selected Disable in the drop-down box VBScript is prevented from running. If you do not configure or disable this policy setting VBScript will run without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58800 (registry_test)
Result:true
Title:Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> 'Allow VBScript to run in Internet Explorer' setting is set to 'Enable' and 'Disable' selected from the drop-down box in Group Policy.
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58800 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name must be equal to '140C'
State ID:oval:mil.disa.fso.ie:ste:58800 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3'
  • name equals '140C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58700 (registry_test)
Result:true
Title:The OS Version is equal to or greater than 6.3
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentVersion'
State ID:oval:mil.disa.fso.ie:ste:58700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '6.3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentVersion'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '6.3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:59000 (registry_test)
Result:false
Title:The OS Build is equal to or greater than 15063
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58701 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentBuildNumber'
State ID:oval:mil.disa.fso.ie:ste:59000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '15063'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentBuildNumber'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '14393'
  • windows_view equals '64_bit'
Additional Information:Check requirement not met.

VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone).

Rule ID:xccdf_mil.disa.stig_rule_SV-89851r1_rule
Result:Pass
Version:DTBI1130-IE11
Identities:CCI-001169 (NIST SP 800-53: SC-18 (3); NIST SP 800-53A: SC-18 (3).1; NIST SP 800-53 Rev 4: SC-18 (3))
Description: This policy setting allows the management of whether VBScript can be run on pages from the specified zone in Internet Explorer. By selecting "Enable" in the drop-down box, VBScript can run without user intervention. By selecting "Prompt" in the drop-down box, users are asked to choose whether to allow VBScript to run. By selecting "Disable" in the drop-down box, VBScript is prevented from running. If this policy setting is not configured or disabled, VBScript will run without user intervention. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Internet Control Panel >> Security Page >> Restricted Sites Zone >> "Allow VBScript to run in Internet Explorer" to "Enabled" and select "Disable" from the drop-down box.
Severity:medium
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:589
Result:true
Title:VBScript must not be allowed to run in Internet Explorer (Restricted Sites zone).
Description:This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer. If you selected Enable in the drop-down box VBScript can run without user intervention. If you selected Prompt in the drop-down box users are asked to choose whether to allow VBScript to run. If you selected Disable in the drop-down box VBScript is prevented from running. If you do not configure or disable this policy setting VBScript will run without user intervention.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:58900 (registry_test)
Result:true
Title:Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Restricted Sites Zone->'Allow VBScript to run in Internet Explorer' setting is set to 'Enable' and 'Disable' selected from the drop-down box in Group Policy.
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58900 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name must be equal to '140C'
State ID:oval:mil.disa.fso.ie:ste:58900 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4'
  • name equals '140C'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:58700 (registry_test)
Result:true
Title:The OS Version is equal to or greater than 6.3
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58700 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentVersion'
State ID:oval:mil.disa.fso.ie:ste:58700 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '6.3'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentVersion'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '6.3'
  • windows_view equals '64_bit'
Test ID:oval:mil.disa.fso.ie:tst:59000 (registry_test)
Result:false
Title:The OS Build is equal to or greater than 15063
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:58701 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Microsoft\Windows NT\CurrentVersion'
  • name must be equal to 'CurrentBuildNumber'
State ID:oval:mil.disa.fso.ie:ste:59000 (registry_state)
State Requirements:
  • all type must be equal to 'reg_sz'
  • all value must be greater than or equal to '15063'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Microsoft\Windows NT\CurrentVersion'
  • name equals 'CurrentBuildNumber'
  • last_write_time equals '132588259360000000'
  • type equals 'reg_sz'
  • value equals '14393'
  • windows_view equals '64_bit'
Additional Information:Check requirement not met.

Internet Explorer Development Tools Must Be Disabled.

Rule ID:xccdf_mil.disa.stig_rule_SV-106631r1_rule
Result:Pass
Version:DTBI1135-IE11
Identities:CCI-001312 (NIST SP 800-53: SI-11 b; NIST SP 800-53A: SI-11.1 (iii); NIST SP 800-53 Rev 4: SI-11 a)
Description: While the risk associated with browser development tools is more related to the proper design of a web application, a risk vector remains within the browser. The developer tools allow end users and application developers to view and edit all types of web application related data via the browser. Page elements, source code, javascript, API calls, application data, etc. may all be viewed and potentially manipulated. Manipulation could be useful for troubleshooting legitimate issues, and this may be performed in a development environment. Manipulation could also be malicious and must be addressed. false
Fix Text:Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> Toolbars >> “Turn off Developer Tools” to “Enabled”.
Severity:low
Weight:10.0
Reference:
Title:DPMS Target IE Version 11
Publisher:DISA
Type:DPMS Target
Subject:IE Version 11
Identifier:2589
Definitions:
Definition ID:oval:mil.disa.fso.ie:def:591
Result:true
Title:DTBI1130-IE11 - Developer Tools
Description:Internet Explorer Development Tools Must Be Disabled.
Class:compliance
Tests:
Tests:
Test ID:oval:mil.disa.fso.ie:tst:59100 (registry_test)
Result:true
Title:Developer Tools are disabled
Check Existence:One or more collected items must exist.
Check:All collected items must match the given state(s).
Object ID:oval:mil.disa.fso.ie:obj:59100 (registry_object)
Object Requirements:
  • hive must be equal to 'HKEY_LOCAL_MACHINE'
  • key must be equal to 'Software\Policies\Microsoft\Internet Explorer\IEDevTools'
  • name must be equal to 'Disabled'
State ID:oval:mil.disa.fso.ie:ste:59100 (registry_state)
State Requirements:
  • all type must be equal to 'reg_dword'
  • all value must be equal to '1'
Collected Item Properties:
  • hive equals 'HKEY_LOCAL_MACHINE'
  • key equals 'Software\Policies\Microsoft\Internet Explorer\IEDevTools'
  • name equals 'Disabled'
  • last_write_time equals '132588259390000000'
  • type equals 'reg_dword'
  • value equals '1'
  • windows_view equals '64_bit'