Ensure 'Restrict ActiveX Install' is set to 'Enabled'

HochStufe 1Automatisiertoffice

Beschreibung

This policy setting enables blocking of ActiveX® control installation prompts for Internet Explorer processes. Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. Rationale: Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like other types of HTML or Microsoft Silverlight-based controls. 'Enabled: check all applications' writes one REG_DWORD 1 per Office executable under HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL; the audit requires all 14 executables the ADMX writes (groove.exe, excel.exe, mspub.exe, powerpnt.exe, pptview.exe, visio.exe, winproj.exe, winword.exe, outlook.exe, spdesign.exe, exprwd.exe, msaccess.exe, onenote.exe, mse7.exe) to be 1 and lists any that are missing or different.

So wird geprüft

Prüfmethode: Windows-Registrierung

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'groove.exe' -ErrorAction SilentlyContinue).'groove.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'groove.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'excel.exe' -ErrorAction SilentlyContinue).'excel.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'excel.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mspub.exe' -ErrorAction SilentlyContinue).'mspub.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mspub.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue).'powerpnt.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'powerpnt.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'pptview.exe' -ErrorAction SilentlyContinue).'pptview.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'pptview.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'visio.exe' -ErrorAction SilentlyContinue).'visio.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'visio.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winproj.exe' -ErrorAction SilentlyContinue).'winproj.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winproj.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winword.exe' -ErrorAction SilentlyContinue).'winword.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winword.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'outlook.exe' -ErrorAction SilentlyContinue).'outlook.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'outlook.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'spdesign.exe' -ErrorAction SilentlyContinue).'spdesign.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'spdesign.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'exprwd.exe' -ErrorAction SilentlyContinue).'exprwd.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'exprwd.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'msaccess.exe' -ErrorAction SilentlyContinue).'msaccess.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'msaccess.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'onenote.exe' -ErrorAction SilentlyContinue).'onenote.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'onenote.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mse7.exe' -ErrorAction SilentlyContinue).'mse7.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mse7.exe=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Shell-Befehl

shell

$p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'groove.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'excel.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mspub.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'powerpnt.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'pptview.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'visio.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winproj.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winword.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'outlook.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'spdesign.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'exprwd.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'msaccess.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'onenote.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mse7.exe' -Value 1 -PropertyType DWord -Force | Out-Null

Eigenschaften

Betriebssysteme: Beliebig
Tags: officeproductivitycis-l1
Referenz: CIS Microsoft Office Enterprise Benchmark v2.0.0 - 1.1.4.1.11 Ensure 'Restrict ActiveX Install' is set to 'Enabled'

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target office