TMA-OFFICE-1.1.4.1.11

Ensure 'Restrict ActiveX Install' is set to 'Enabled'

HighLevel 1Automatedoffice

Description

This policy setting enables blocking of ActiveX® control installation prompts for Internet Explorer processes. Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. Rationale: Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like other types of HTML or Microsoft Silverlight-based controls. 'Enabled: check all applications' writes one REG_DWORD 1 per Office executable under HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL; the audit requires all 14 executables the ADMX writes (groove.exe, excel.exe, mspub.exe, powerpnt.exe, pptview.exe, visio.exe, winproj.exe, winword.exe, outlook.exe, spdesign.exe, exprwd.exe, msaccess.exe, onenote.exe, mse7.exe) to be 1 and lists any that are missing or different.

How it is checked

Audit method: Windows registry

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'groove.exe' -ErrorAction SilentlyContinue).'groove.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'groove.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'excel.exe' -ErrorAction SilentlyContinue).'excel.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'excel.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mspub.exe' -ErrorAction SilentlyContinue).'mspub.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mspub.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue).'powerpnt.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'powerpnt.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'pptview.exe' -ErrorAction SilentlyContinue).'pptview.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'pptview.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'visio.exe' -ErrorAction SilentlyContinue).'visio.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'visio.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winproj.exe' -ErrorAction SilentlyContinue).'winproj.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winproj.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winword.exe' -ErrorAction SilentlyContinue).'winword.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winword.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'outlook.exe' -ErrorAction SilentlyContinue).'outlook.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'outlook.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'spdesign.exe' -ErrorAction SilentlyContinue).'spdesign.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'spdesign.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'exprwd.exe' -ErrorAction SilentlyContinue).'exprwd.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'exprwd.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'msaccess.exe' -ErrorAction SilentlyContinue).'msaccess.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'msaccess.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'onenote.exe' -ErrorAction SilentlyContinue).'onenote.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'onenote.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mse7.exe' -ErrorAction SilentlyContinue).'mse7.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mse7.exe=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Expected output: compliant

How it is fixed

Fix method: Shell command

shell

$p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'groove.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'excel.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mspub.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'powerpnt.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'pptview.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'visio.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winproj.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winword.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'outlook.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'spdesign.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'exprwd.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'msaccess.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'onenote.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mse7.exe' -Value 1 -PropertyType DWord -Force | Out-Null

Properties

Operating systems: Any
Tags: officeproductivitycis-l1
Reference: CIS Microsoft Office Enterprise Benchmark v2.0.0 - 1.1.4.1.11 Ensure 'Restrict ActiveX Install' is set to 'Enabled'

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target office