Ensure 'Restrict ActiveX Install' is set to 'Enabled'

VisokaNivo 1Automatskaoffice

Opis

This policy setting enables blocking of ActiveX® control installation prompts for Internet Explorer processes. Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. Rationale: Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like other types of HTML or Microsoft Silverlight-based controls. 'Enabled: check all applications' writes one REG_DWORD 1 per Office executable under HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL; the audit requires all 14 executables the ADMX writes (groove.exe, excel.exe, mspub.exe, powerpnt.exe, pptview.exe, visio.exe, winproj.exe, winword.exe, outlook.exe, spdesign.exe, exprwd.exe, msaccess.exe, onenote.exe, mse7.exe) to be 1 and lists any that are missing or different.

Kako se proverava

Metod provere: Windows registar

registry

$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'groove.exe' -ErrorAction SilentlyContinue).'groove.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'groove.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'excel.exe' -ErrorAction SilentlyContinue).'excel.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'excel.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mspub.exe' -ErrorAction SilentlyContinue).'mspub.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mspub.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue).'powerpnt.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'powerpnt.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'pptview.exe' -ErrorAction SilentlyContinue).'pptview.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'pptview.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'visio.exe' -ErrorAction SilentlyContinue).'visio.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'visio.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winproj.exe' -ErrorAction SilentlyContinue).'winproj.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winproj.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winword.exe' -ErrorAction SilentlyContinue).'winword.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winword.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'outlook.exe' -ErrorAction SilentlyContinue).'outlook.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'outlook.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'spdesign.exe' -ErrorAction SilentlyContinue).'spdesign.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'spdesign.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'exprwd.exe' -ErrorAction SilentlyContinue).'exprwd.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'exprwd.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'msaccess.exe' -ErrorAction SilentlyContinue).'msaccess.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'msaccess.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'onenote.exe' -ErrorAction SilentlyContinue).'onenote.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'onenote.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mse7.exe' -ErrorAction SilentlyContinue).'mse7.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mse7.exe=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Komanda ljuske

shell

$p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'groove.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'excel.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mspub.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'powerpnt.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'pptview.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'visio.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winproj.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winword.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'outlook.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'spdesign.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'exprwd.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'msaccess.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'onenote.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mse7.exe' -Value 1 -PropertyType DWord -Force | Out-Null

Svojstva

Operativni sistemi: Bilo koji
Oznake: officeproductivitycis-l1
Referenca: CIS Microsoft Office Enterprise Benchmark v2.0.0 - 1.1.4.1.11 Ensure 'Restrict ActiveX Install' is set to 'Enabled'

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target office