Ensure 'Hidden text' is set to 'Enabled'

AltaNivel 1Automatizadaoffice

Descripción

This policy setting controls whether text that is formatted as hidden displays in Microsoft Word. The recommended state for this setting is: Enabled. Rationale: By default, Word does not display text formatted as hidden unless "Show/Hide ¶" is selected or Word is configured to show hidden text in the Display section of the Word Options dialog box. If a document that contains hidden text is distributed, sensitive information in the document could be at risk. User setting: the audit checks HKEY_USERS\<SID>\SOFTWARE\Policies\Microsoft\office\16.0\word\options:showhiddentext (REG_DWORD) in every loaded user hive (S-1-5-21-*) and is compliant when each holds 1. It prints 'no-user-hive-loaded' (FAIL) when no user profile is loaded, so scan while users are logged on.

Cómo se verifica

Método de auditoría: Registro de Windows

registry

$sids = @(Get-ChildItem -Path 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $_.PSChildName }); if ($sids.Count -eq 0) { 'no-user-hive-loaded' } else { $bad = @(); foreach ($s in $sids) { $v = (Get-ItemProperty -Path ('Registry::HKEY_USERS\' + $s + '\SOFTWARE\Policies\Microsoft\office\16.0\word\options') -Name 'showhiddentext' -ErrorAction SilentlyContinue).'showhiddentext'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += $s + ':showhiddentext=' + $v } }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') } }

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Configure through Group Policy (User Configuration): User Configuration\Administrative Templates\Microsoft Word 2016\Word Options\Display\Hidden text = Enabled

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: officeproductivitycis-l1
Referencia: CIS Microsoft Office Enterprise Benchmark v2.0.0 - 2.11.8.3.1 Ensure 'Hidden text' is set to 'Enabled'

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target office