Ensure 'Hidden text' is set to 'Enabled'

HighLevel 1Automatedoffice

Description

This policy setting controls whether text that is formatted as hidden displays in Microsoft Word. The recommended state for this setting is: Enabled. Rationale: By default, Word does not display text formatted as hidden unless "Show/Hide ¶" is selected or Word is configured to show hidden text in the Display section of the Word Options dialog box. If a document that contains hidden text is distributed, sensitive information in the document could be at risk. User setting: the audit checks HKEY_USERS\<SID>\SOFTWARE\Policies\Microsoft\office\16.0\word\options:showhiddentext (REG_DWORD) in every loaded user hive (S-1-5-21-*) and is compliant when each holds 1. It prints 'no-user-hive-loaded' (FAIL) when no user profile is loaded, so scan while users are logged on.

How it is checked

Audit method: Windows registry

registry

$sids = @(Get-ChildItem -Path 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $_.PSChildName }); if ($sids.Count -eq 0) { 'no-user-hive-loaded' } else { $bad = @(); foreach ($s in $sids) { $v = (Get-ItemProperty -Path ('Registry::HKEY_USERS\' + $s + '\SOFTWARE\Policies\Microsoft\office\16.0\word\options') -Name 'showhiddentext' -ErrorAction SilentlyContinue).'showhiddentext'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += $s + ':showhiddentext=' + $v } }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') } }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Configure through Group Policy (User Configuration): User Configuration\Administrative Templates\Microsoft Word 2016\Word Options\Display\Hidden text = Enabled

Properties

Operating systems: Any
Tags: officeproductivitycis-l1
Reference: CIS Microsoft Office Enterprise Benchmark v2.0.0 - 2.11.8.3.1 Ensure 'Hidden text' is set to 'Enabled'

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target office