TMA-CHROME-2.3.3
Ensure 'Configure extension installation blocklist' is set to 'Enabled: *'
Açıklama
Enabling this setting allows you to specify which extensions the users can NOT install. Extensions already installed will be removed if blocklisted. Disabled (0): then the user can install any extension in Google Chrome. Rationale: This can be used to block extensions that could potentially allow remote control of the system through the browser. If there are extensions needed for securing the browser or for enterprise use, these can be enabled by configuring either the setting Configure extension installation allowlist or the... List policy: numbered REG_SZ values under HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist. Compliant when one entry equals '*'; 'unset' when the list is empty.
Nasıl denetlenir
Denetim yöntemi: Windows kayıt defteri
$l = @((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist' -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Name -notlike 'PS*' } | ForEach-Object { "$($_.Value)" }); if ($l.Count -eq 0) { 'unset' } elseif ($l -contains '*') { 'compliant' } else { 'non-compliant: ' + ($l -join ', ') }- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Configure through Group Policy: Computer Configuration\Polices\Administrative Templates\Google\Google Chrome\Extensions\Configure extension installation blocklist = Enabled and a value of * for Extension IDs the user should be prevented from installing. Populate ExtensionInstallAllowlist with approved extension IDs before blocking '*'.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- chromebrowsercis-l1
- Referans
- CIS Google Chrome Benchmark v3.0.0 - 2.3.3 Ensure 'Configure extension installation blocklist' is set to 'Enabled: *'
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target chrome