TMA-OFFICE-1.1.4.1.11
Ensure 'Restrict ActiveX Install' is set to 'Enabled'
高级别 1自动化office
说明
This policy setting enables blocking of ActiveX® control installation prompts for Internet Explorer processes. Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to networks. Rationale: Microsoft ActiveX controls allow unmanaged, unprotected code to run on the user computers. ActiveX controls do not run within a protected container in the browser like other types of HTML or Microsoft Silverlight-based controls. 'Enabled: check all applications' writes one REG_DWORD 1 per Office executable under HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL; the audit requires all 14 executables the ADMX writes (groove.exe, excel.exe, mspub.exe, powerpnt.exe, pptview.exe, visio.exe, winproj.exe, winword.exe, outlook.exe, spdesign.exe, exprwd.exe, msaccess.exe, onenote.exe, mse7.exe) to be 1 and lists any that are missing or different.
检查方式
审计方法: Windows 注册表
registry
$bad = @(); $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'groove.exe' -ErrorAction SilentlyContinue).'groove.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'groove.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'excel.exe' -ErrorAction SilentlyContinue).'excel.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'excel.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mspub.exe' -ErrorAction SilentlyContinue).'mspub.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mspub.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue).'powerpnt.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'powerpnt.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'pptview.exe' -ErrorAction SilentlyContinue).'pptview.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'pptview.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'visio.exe' -ErrorAction SilentlyContinue).'visio.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'visio.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winproj.exe' -ErrorAction SilentlyContinue).'winproj.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winproj.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'winword.exe' -ErrorAction SilentlyContinue).'winword.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'winword.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'outlook.exe' -ErrorAction SilentlyContinue).'outlook.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'outlook.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'spdesign.exe' -ErrorAction SilentlyContinue).'spdesign.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'spdesign.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'exprwd.exe' -ErrorAction SilentlyContinue).'exprwd.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'exprwd.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'msaccess.exe' -ErrorAction SilentlyContinue).'msaccess.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'msaccess.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'onenote.exe' -ErrorAction SilentlyContinue).'onenote.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'onenote.exe=' + $v }; $v = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL' -Name 'mse7.exe' -ErrorAction SilentlyContinue).'mse7.exe'; if (-not ($null -ne $v -and @(1) -contains [int64]$v)) { $bad += 'mse7.exe=' + $v }; if ($bad.Count -eq 0) { 'compliant' } else { 'non-compliant: ' + ($bad -join ', ') }- 预期输出
compliant
修复方式
修复方法: Shell 命令
shell
$p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'groove.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'excel.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mspub.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'powerpnt.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'pptview.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'visio.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winproj.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'winword.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'outlook.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'spdesign.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'exprwd.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'msaccess.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'onenote.exe' -Value 1 -PropertyType DWord -Force | Out-Null; $p = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL'; if (-not (Test-Path -Path $p)) { New-Item -Path $p -Force | Out-Null }; New-ItemProperty -Path $p -Name 'mse7.exe' -Value 1 -PropertyType DWord -Force | Out-Null属性
- 操作系统
- 任意
- 标签
- officeproductivitycis-l1
- 参考
- CIS Microsoft Office Enterprise Benchmark v2.0.0 - 1.1.4.1.11 Ensure 'Restrict ActiveX Install' is set to 'Enabled'
检查本机
请在您有权审计的机器上运行此命令。扫描为只读操作。
shell
tmaegis scan --target office