Ensure 'Hidden text' is set to 'Enabled'

高レベル 1自動office

説明

This policy setting controls whether text that is formatted as hidden displays in Microsoft Word. The recommended state for this setting is: Enabled. Rationale: By default, Word does not display text formatted as hidden unless "Show/Hide ¶" is selected or Word is configured to show hidden text in the Display section of the Word Options dialog box. If a document that contains hidden text is distributed, sensitive information in the document could be at risk. User setting: the audit checks HKEY_USERS\<SID>\SOFTWARE\Policies\Microsoft\office\16.0\word\options:showhiddentext (REG_DWORD) in every loaded user hive (S-1-5-21-*) and is compliant when each holds 1. It prints 'no-user-hive-loaded' (FAIL) when no user profile is loaded, so scan while users are logged on.

チェック方法

監査方法: Windows レジストリ

registry

$sids = @(Get-ChildItem -Path 'Registry::HKEY_USERS' -ErrorAction SilentlyContinue | Where-Object { $_.PSChildName -match '^S-1-5-21-\d+-\d+-\d+-\d+$' } | ForEach-Object { $_.PSChildName }); if ($sids.Count -eq 0) { 'no-user-hive-loaded' } else { $bad = @(); foreach ($s in $sids) { $v = (Get-ItemProperty -Path ('Registry::HKEY_USERS\' + $s + '\SOFTWARE\Policies\Microsoft\office\16.0\word\options') -Name 'showhiddentext' -ErrorAction SilentlyContinue).'showhiddentext'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += $s + ':showhiddentext=' + $v } }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') } }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Configure through Group Policy (User Configuration): User Configuration\Administrative Templates\Microsoft Word 2016\Word Options\Display\Hidden text = Enabled

プロパティ

オペレーティングシステム: すべて
タグ: officeproductivitycis-l1
参照: CIS Microsoft Office Enterprise Benchmark v2.0.0 - 2.11.8.3.1 Ensure 'Hidden text' is set to 'Enabled'

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target office