accepted ALPHA: Guidance for Securing Microsoft Internet Explorer 8 for IT Professionals This guide has been created to assist IT professionals in effectively securing systems with Microsoft Internet Explorer 8 installed. Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. NIST assumes no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic. NIST would appreciate acknowledgement if the document and template are used. todo - add text Trademark Information Microsoft, Windows, Windows XP, Windows Vista, Internet Explorer, and Windows Firewall are either registered trademarks or trademarks of Microsoft Corporation in the United States and other countries. All other names are registered trademarks or trademarks of their respective companies. National Institute of Standards and Technology SP 800-68 v1.1.0.0 National Institute of Standards and Technology National Institute of Standards and Technology National Institute of Standards and Technology http://alpha.nist.gov United States Government Configuration Baseline version 1.1.0.0 This profile represents guidance outlined by the Federal Core Configuration for a desktop system with Microsoft Internet Explorer 8 installed. Introduction This guide has been created to assist federal agencies in effectively securing systems with Microsoft Windows Internet Explorer 8based on OMB United States Government Configuration Baseline recommendations. Under the direction of OMB and in collaboration with DHS, DISA, NSA, USAF, and Microsoft, NIST has provided the following baseline to help agencies test, implement, and deploy the Microsoft Windows Internet Explorer 8United States Government Configuration Baseline (ALPHA) baseline. The United States Government Configuration Baseline (ALPHA) is an OMB-mandated security configuration. Please refer to the ALPHA home page for additional information. http://ALPHA.nist.gov ALPHA Other Settings ALPHA has identified the following additional controls that must be checked in order to verify compliance. Local Computer Policy todo - description needed Core Policy The following are some additional settings for Microsoft Internet Explorer 8 DisableConfiguringHistory_LocalComputer_1_var DisableConfiguringHistory_LocalComputer_1_var 1 1 DisableConfiguringHistory_LocalComputer_2_var DisableConfiguringHistory_LocalComputer_2_var 40 40 DisableChangingAutomaticConfigurationSettings_LocalComputer_var DisableChangingAutomaticConfigurationSettings_LocalComputer_var 1 1 DoNotAllowUsersEnableDisableAddOns_LocalComputer_var DoNotAllowUsersEnableDisableAddOns_LocalComputer_var 1 1 0 MakeProxySettingsPerMachine_LocalComputer_var MakeProxySettingsPerMachine_LocalComputer_var 1 1 0 PreventParticipationInCustomerExperienceImprovementPrograms_LocalComputer_var PreventParticipationInCustomerExperienceImprovementPrograms_LocalComputer_var 0 1 0 PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var 1 1 2 DoNotAllowUsersAddDeleteSites_LocalComputer_var DoNotAllowUsersAddDeleteSites_LocalComputer_var 1 1 DoNotAllowUsersChangePolicies_LocalComputer_var DoNotAllowUsersChangePolicies_LocalComputer_var 1 1 UseOnlyMachineSettings_LocalComputer_var UseOnlyMachineSettings_LocalComputer_var 1 1 TurnOffCrashDetection_LocalComputer_var TurnOffCrashDetection_LocalComputer_var 1 1 TurnoffManagingSmartScreenFilter_LocalComputer_var TurnoffManagingSmartScreenFilter_LocalComputer_var 0 0 1 TurnOffSecuritySettingsCheckFeature_LocalComputer_var TurnOffSecuritySettingsCheckFeature_LocalComputer_var 0 0 1 Disable "Configuring History" - Local Computer This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options and General tab. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History CCE-10387-9 CCE-66 Disable Changing Automatic Configuration Settings - Local Computer This policy setting removes a user's ability to change automatically configured settings. Administrators can use automatic configuration to update browser settings periodically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10638-5 CCE-471 Do Not Allow Users to enable or Disable Add-Ons - Local Computer The Do not allow users to enable or disable add-ons policy setting allows you to manage whether users have the ability to allow or deny add-ons through Manage Add-ons. If you configure this policy setting to Enabled, users cannot enable or disable add-ons. This item is disabled. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10235-0 CCE-708 Make proxy settings per-machine (rather than per-user) - Local Computer The Make proxy settings per – machine (rather than per-user) setting ensures proxy settings for all users of the same computer are the same. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-9870-7 CCE-693 Prevent participation in the Customer Experience Improvement Programs - Local Computer This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10522-1 CCE-495 Prevent performance of First Run Customize settings - Local Computer This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10641-9 CCE-1006 Security Zones: Do Not Allow Users to Add/Delete Sites - Local Computer The Security Zones: Do not allow users to add/delete sites setting prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10394-5 CCE-146 Security Zones: Do Not Allow Users to Change Policies - Local Computer The Security Zones: Do not allow users to change policies setting prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10037-0 CCE-833 Security Zones: Use Only Machine Settings - Local Computer Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level. If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10096-6 CCE-5 Turn Off Crash Detection - Local Computer The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10594-0 CCE-753 Turn Off Managing SmartScreen Filter - Local Computer This policy setting allows the user to enable the SmartScreen Filter, which will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-9973-9 Turn Off the Security Settings Check Feature - Local Computer This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-10607-0 CCE-1054 Compatibility View - Local Computer Compatibility View - Local Computer IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var 0 0 1 Include updated Web site lists from Microsoft - Local Computer This policy controls the Web site compatibility lists provided by Microsoft. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Compatibility View CCE-10603-9 Delete Browsing History - Local Computer Delete Browsing History - Local Computer ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var 0 0 1 PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var 0 1 0 Configure Delete Browsing History on exit - Local Computer Delete Browsing History on exit automatically deletes specified items when the last browser windows closes. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History CCE-10590-8 Prevent Deleting Web sites that the User has Visited - Local Computer This policy setting prevents users from deleting the history of webs sites the user has visited. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History CCE-10110-5 InPrivate - Local Computer InPrivate - Local Computer TurnOffInPrivateBrowsing_LocalComputer_var TurnOffInPrivateBrowsing_LocalComputer_var 0 1 0 Turn off InPrivate Browsing - Local Computer This policy setting allows you to disable the InPrivate Browsing feature. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\InPrivate CCE-9885-5 Advanced Page - Local Computer Advanced Page - Local Computer Allow active content from CDs to run on user machines - Local Computer - variable Allow Active Content from CD's to Run on User Machine - Local Computer - variable 0 0 1 Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable 0 0 1 Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable no no yes Allow Third-Party Browser Extensions - Local Computer - variable Allow Third-Party Browser Extensions - Local Computer - variable 1 1 0 Check for Server Certificate Revocation - Local Computer - variable Check for Server Certificate Revocation - Local Computer - variable 1 0 1 Check for signatures on downloaded programs - Local Computer - variable Check for Signature on Downloaded Programs - Local Computer - variable yes no yes Allow Active Content from CDs to Run on User Machine - Local Computer This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-10293-9 CCE-964 Allow Software to Run or Install Even if the Signature is Invalid - Local Computer Microsoft ActiveX controls and file downloads often have digital signatures attached that vouch for both the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure that unmodified. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-10052-9 CCE-449 Allow Third-Party Browser Extensions - Local Computer This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such as toolbars. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-9905-1 CCE-598 Automatically Check for Internet Explorer Updates - Local Computer This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-10581-7 CCE-1008 Check for Server Certificate Revocation - Local Computer This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-10074-3 CCE-690 Check for signatures on downloaded programs - Local Computer - variable This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-10055-2 CCE-1025 Security Page Policy Security Page - Local Computer IncludeAllNetworkPaths_LocalComputer_var IncludeAllNetworkPaths_LocalComputer_var 0 0 1 Intranet Sites: Include all network paths (UNCs) - Local Computer This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page CCE-9660-2 CCE-876 Internet Zone - Local Computer Internet Zone - Local Computer AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var 3 0 1 3 AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var 3 0 1 3 AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var 3 0 1 3 AllowFontDownloads_InternetZone_LocalComputer_var AllowFontDownloads_InternetZone_LocalComputer_var 3 0 1 3 AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var 3 0 1 3 AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var 3 0 3 AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var 3 0 3 AllowScriptlets_InternetZone_LocalComputer_var AllowScriptlets_InternetZone_LocalComputer_var 3 0 3 AllowStatusBarUpdatesViaScript_InternetZone_LocalComputer_var AllowStatusBarUpdatesViaScript_InternetZone_LocalComputer_var 0 0 0 1 3 AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var 0 0 3 DownloadSignedActiveXControls_InternetZone_LocalComputer_var DownloadSignedActiveXControls_InternetZone_LocalComputer_var 3 0 1 3 DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var 3 0 1 3 IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var 3 0 3 InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var 3 0 1 3 JavaPermissions_InternetZone_LocalComputer_var JavaPermissions_InternetZone_LocalComputer_var 0 0 65536 131072 196608 8388608 LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var 3 0 1 3 LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var 1 0 1 3 LogonOptions_InternetZone_LocalComputer_var LogonOptions_InternetZone_LocalComputer_var 65536 0 65536 131072 196608 LooseXAMLFiles_InternetZone_LocalComputer_var LooseXAMLFiles_InternetZone_LocalComputer_var 3 0 1 3 NavigateSubFramesAcrossDifferentDomains_InternetZone_LocalComputer_var NavigateSubFramesAcrossDifferentDomains_InternetZone_LocalComputer_var 3 0 1 3 OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var 3 3 0 OpenFilesBasedOnContent_InternetZone_LocalComputer_var OpenFilesBasedOnContent_InternetZone_LocalComputer_var 3 0 3 RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var 3 0 1 3 RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var 3 0 1 3 SoftwareChannelPermissions_InternetZone_LocalComputer_var SoftwareChannelPermissions_InternetZone_LocalComputer_var 65536 65536 131072 196608 TurnOffFirstRunOptIn_InternetZone_LocalComputer_var todo - description needed 0 0 3 TurnonCrossSiteScriptingFilter_InternetZone_LocalComputer_var TurnonCrossSiteScriptingFilter_InternetZone_LocalComputer_var 3 0 3 TurnOnProtectedMode_InternetZone_LocalComputer_var todo - description needed 0 0 3 UsePop-upBlocker_InternetZone_LocalComputer_var UsePop-upBlocker_InternetZone_LocalComputer_var 0 0 1 3 UserdataPersistence_InternetZone_LocalComputer_var UserdataPersistence_InternetZone_LocalComputer_var 3 0 3 WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var 3 0 1 3 Access Data Sources Across Domains - Internet Zone - Local Computer This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10380-4 CCE-47 Allow cut, copy or paste operations from the clipboard via script - Internet Zone - Local Computer This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10002-4 CCE-49 Allow drag and drop or copy and paste files - Internet Zone - Local Computer This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10033-9 CCE-685 Allow Font Downloads - Internet Zone - Local Computer This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10403-4 CCE-491 Allow installation of desktop items - Internet Zone - Local Computer This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9790-7 CCE-355 Allow scripting of Internet Explorer web browser control - Internet Zone - Local Computer This policy setting controls whether a page may control embedded WebBrowser Controls via script GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9779-0 Allow script-initiated windows without size or position constraints - Internet Zone - Local Computer This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9882-2 CCE-280 Allow Scriptlets - Internet Zone - Local Computer This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10685-6 CCE-439 Allow status bar updates via script - Internet Zone - Local Computer This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9750-1 CCE-914 Automatic prompting for file downloads - Internet Zone - Local Computer This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10389-5 CCE-16 Download signed ActiveX controls - Internet Zone - Local Computer This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9917-6 CCE-1013 Download unsigned ActiveX controls - Internet Zone - Local Computer This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10433-1 CCE-176 Include local directory path when uploading files to a server - Internet Zone - Local Computer This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10646-8 Initialize and script ActiveX controls not marked as safe - Internet Zone - Local Computer This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10561-9 CCE-586 Java permissions - Internet Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10182-4 CCE-132 Launching applications and files in an IFRAME - Internet Zone - Local Computer This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9821-0 CCE-689 Launching programs and unsafe files - Internet Zone - Local Computer This policy setting controls whether or not the 'Open File - Security Warning' prompt is shown when launching executables or other unsafe files. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10650-0 Logon Options - Internet Zone - Local Computer This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10472-9 CCE-720 Loose XAML files - Internet Zone - Local Computer These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10672-4 CCE-126 Navigate windows and frames across different domains - Internet Zone - Local Computer This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9865-7 CCE-245 Only allow approved domains to use ActiveX controls without prompt - Internet Zone - Local Computer This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-9793-1 Open files based on content, not file extension - Internet Zone - Local Computer This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10107-1 CCE-910 Run .NET Framework-reliant components not signed with Authenticode - Internet Zone - Local Computer This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10515-5 Run .NET Framework-reliant components signed with Authenticode - Internet Zone - Local Computer This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10625-2 Software channel permissions - Internet Zone - Local Computer This policy setting allows you to manage software channel permissions. If you enable this policy setting, you can choose the following options from the drop-down box. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10425-7 CCE-359 Turn Off First-Run Opt-In - Internet Zone - Local Computer Turn Off First-Run Opt-In GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10434-9 CCE-863 Turn on Cross-Site Scripting (XSS) Filter - Internet Zone - Local Computer This policy setting controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10276-4 Turn On Protected Mode - Internet Zone - Local Computer The "Turn on Protected Mode" setting should be configured correctly for the Internet Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10676-5 CCE-281 Use Pop-up Blocker - Internet Zone - Local Computer This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10486-9 CCE-1002 Userdata Persistence - Internet Zone - Local Computer This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10200-4 CCE-425 Web sites in less privileged Web content zones can navigate into this zone - Internet Zone - Local Computer This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-10622-9 CCE-724 Intranet Zone - Local Computer Intranet Zone - Local Computer JavaPermissions_IntranetZone_LocalComputer_var JavaPermissions_IntranetZone_LocalComputer_var 0 0 65536 131072 196608 8388608 Java permissions - Intranet Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone CCE-10566-8 CCE-218 Local Machine Zone - Local Computer Local Machine Zone - Local Computer JavaPermissions_LocalMachineZone_LocalComputer_var JavaPermissions_LocalMachineZone_LocalComputer_var 0 0 0 65536 131072 196608 8388608 Java permissions - Local Machine Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone CCE-10319-2 CCE-138 Locked Down Internet Zone - Local Computer Locked Down Internet Zone - Local Computer DownloadSignedActiveXControls_LockedDownInternetZone_LocalComputer_var todo - description needed 3 0 1 3 JavaPermissions_LockedDownInternetZone_LocalComputer_var todo - description needed 0 0 65536 131072 196608 8388608 Download Signed ActiveX Controls - Locked Down Internet Zone - Local Computer The "Download signed ActiveX controls" setting should be configured correctly for the Locked-Down Internet Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone CCE-10095-8 CCE-308 Java permissions - Locked Down Internet Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone CCE-10597-3 CCE-781 Locked Down Intranet Zone - Local Computer LockedDown Intranet Zone - Local Computer JavaPermissions_LockedDownIntranetZone_LocalComputer_var JavaPermissions_LockedDownIntranetZone_LocalComputer_var 0 0 65536 131072 196608 8388608 Java permissions - Locked Down Intranet Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone CCE-10342-4 CCE-320 Locked Down Local Machine Zone - Local Computer Locked Down Local Machine Zone - Local Computer JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var 0 0 65536 131072 196608 8388608 Java permissions - Locked Down Local Machine - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone CCE-10535-3 CCE-1045 Locked Down Restricted Sites Zone - Local Compute - Local Computer Locked Down Restricted Sites Zone - Local Computer JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var 0 0 65536 131072 196608 8388608 Java permissions - Locked Down Restricted Sites Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone CCE-10275-6 CCE-1088 Locked Down Trusted Sites Zone - Local Computer - Local Compute Locked Down Trusted Sites Zone - Local Computer JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var 0 0 65536 131072 196608 8388608 Java permissions - Locked Down Trusted Sites Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone CCE-10654-2 CCE-140 Restricted Sites Zone - Local Computer Restricted Sites Zone - Local Computer AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowActiveScripting_RestrictedSitesZone_LocalComputer_var AllowActiveScripting_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowFileDownloads_RestrictedSitesZone_LocalComputer_var AllowFileDownloads_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowFontDownloads_RestrictedSitesZone_LocalComputer_var AllowFontDownloads_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var 3 0 3 AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var 3 0 3 AllowScriptlets_RestrictedSitesZone_LocalComputer_var AllowScriptlets_RestrictedSitesZone_LocalComputer_var 3 0 3 AllowStatusBarUpdatesViaScript_RestrictedSitesZone_LocalComputer_var AllowStatusBarUpdatesViaScript_RestrictedSitesZone_LocalComputer_var 0 0 0 1 3 AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var 3 0 3 DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var 3 0 1 3 DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var 3 0 1 3 IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var 3 0 3 InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var 3 0 1 3 JavaPermissions_RestrictedSitesZone_LocalComputer_var JavaPermissions_RestrictedSitesZone_LocalComputer_var 0 0 65536 131072 196608 8388608 LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var 3 0 1 3 LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var 3 0 1 3 LogonOptions_RestrictedSitesZone_LocalComputer_var LogonOptions_RestrictedSitesZone_LocalComputer_var 196608 0 65536 131072 196608 LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var 3 0 1 3 NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var 3 0 1 3 OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var 3 3 0 OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var 3 0 3 RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var 3 0 1 3 RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var 3 0 1 3 RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var 3 0 1 3 ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var 3 0 1 3 ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var 3 0 1 3 SoftwareChannelPermissions_RestrictedSitesZone_LocalComputer_var SoftwareChannelPermissions_RestrictedSitesZone_LocalComputer_var 65536 65536 131072 196608 TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var 0 0 3 TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var 0 0 3 TurnOnProtectedMode_RestrictedSitesZone_LocalComputer_var todo - description needed 0 0 3 UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var 0 0 1 3 UserdataPersistence_RestrictedSitesZone_LocalComputer_var UserdataPersistence_RestrictedSitesZone_LocalComputer_var 3 0 3 WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var 3 0 1 3 Access Data Sources Across Domains - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10525-4 CCE-636 Allow Active Scripting - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether script code on pages in the zone is run. If you enable this policy setting, script code on pages in the zone can run automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10393-7 CCE-292 Allow Binary and Script Behaviors - Restricted Sites Zone - Local Computer This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10547-8 CCE-178 Allow cut, copy or paste operations from the clipboard via script - Restricted SitesZone - Local Computer This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10539-5 CCE-1031 Allow drag and drop or copy and paste files - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9667-7 CCE-41 Allow File Downloads - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10466-1 CCE-970 Allow Font Downloads - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9982-0 CCE-882 Allow installation of desktop items - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10475-2 CCE-763 Allow scripting of Internet Explorer web browser control - Restricted Sites Zone - Local Computer This policy setting controls whether a page may control embedded WebBrowser Controls via script GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10725-0 Allow META REFRESH - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10664-1 CCE-680 Allow script-initiated windows without size or position constraints - Restricted Sites Zone - Local Computer This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9814-5 CCE-208 Allow Scriptlets - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10630-2 Allow status bar updates via script - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10431-5 CCE-129 Automatic prompting for file downloads - Restricted Sites Zone - Local Computer This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9959-8 CCE-175 Download signed ActiveX controls - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10470-3 CCE-52 Download unsigned ActiveX controls - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10461-2 CCE-1012 Include local directory path when uploading files to a server - Restricted Sites Zone - Local Computer This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9781-6 Initialize and script ActiveX controls not marked as safe - Restricted Sites Zone - Local Computer This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10347-3 CCE-26 Java permissions - Restricted Sites Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10620-3 CCE-1088 Launching applications and files in an IFRAME - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10360-6 CCE-339 Launching programs and unsafe files - Restricted Sites Zone - Local Computer This policy setting controls whether or not the 'Open File - Security Warning' prompt is shown when launching executables or other unsafe files. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10744-1 Logon Options - Restricted Sites Zone - Local Computer This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10651-8 CCE-128 Loose XAML files - Restricted Sites Zone - Local Computer These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10178-2 CCE-639 Navigate sub-frames across different domains - Restricted Sites Zone - Local Computer This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10642-7 CCE-995 Only allow approved domains to use ActiveX controls without prompt - Restricted Sites Zone - Local Computer This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9832-7 Open files based on content, not file extension - Restricted Sites Zone - Local Computer This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10277-2 CCE-409 Run .NET Framework-reliant components not signed with Authenticode - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9898-8 CCE-678 Run .NET Framework-reliant components signed with Authenticode - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9673-5 CCE-563 Run ActiveX controls and plugins - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. If you enable this policy setting, controls and plug-ins can run without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9792-3 CCE-841 Script ActiveX controls marked safe for scripting - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10554-4 CCE-973 Scripting of Java Applets - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10083-4 CCE-1000 Software channel permissions - Restricted Sites Zone - Local Computer This policy setting allows you to manage software channel permissions. If you enable this policy setting, you can choose the following options from the drop-down box. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9669-3 CCE-520 Turn Off First-Run Opt-In - Restricted Sites Zone - Local Computer Turn Off First-Run Opt-In GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10420-8 CCE-200 Turn on Cross-Site Scripting (XSS) Filter - Restricted Sites Zone - Local Computer This policy setting controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10105-5 Turn On Protected Mode - Restricted Sites Zone - Local Computer The "Turn on Protected Mode" setting should be configured correctly for the Restricted Sites Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9945-7 CCE-1211 Use Pop-up Blocker - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10094-1 CCE-660 Userdata Persistence - Restricted Sites Zone - Local Computer This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-9760-0 CCE-28 Web sites in less privileged Web content zones can navigate into this zone - Restricted Sites Zone - Local Computer This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-10609-6 CCE-698 Trusted Sites Zone - Local Computer - Local Compute Trusted Sites Zone - Local Computer JavaPermissions_TrustedSitesZone_LocalComputer_var JavaPermissions_TrustedSitesZone_LocalComputer_var 0 0 65536 131072 196608 8388608 Java permissions - Trusted Sites Zone - Local Computer This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone CCE-10696-3 CCE-675 Periodic Check for Updates - Local Computer Periodic Check for Updates to Internet Explorer and Internet Tools - Local Computer TurnOffChangingURLDisplay_LocalComputer_var TurnOffChangingURLDisplay_LocalComputer_var TurnOffConfiguringUpdateCheckInterval_LocalComputer_var TurnOffConfiguringUpdateCheckInterval_LocalComputer_var 30 30 Turn Off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools - Local Computer This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodic check for updates to Internet Explorer and Internet Tools CCE-10595-7 CCE-946 Turn Off Configuring the Update Check Interval (In Days) - Local Computer This setting specifies the update check interval. The default value is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodic check for updates to Internet Explorer and Internet Tools CCE-9776-6 CCE-237 Security Features Policy todo - description needed Consistent Mime Handling - Local Computer Consistent Mime Handling - Local Computer IEProcesses_ConsistentMimeHandling_LocalComputer_1_var IEProcesses_ConsistentMimeHandling_LocalComputer_1_var 1 0 1 IEProcesses_ConsistentMimeHandling_LocalComputer_2_var IEProcesses_ConsistentMimeHandling_LocalComputer_2_var 1 0 1 IEProcesses_ConsistentMimeHandling_LocalComputer_3_var IEProcesses_ConsistentMimeHandling_LocalComputer_3_var 1 0 1 Internet Explorer Processes - Consistent Mime Handling - Local Computer Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling CCE-10138-6 CCE-382 Mime Sniffing Safety Feature - Local Computer Mime Sniffing Safety Feature - Local Computer IEProcesses_MimeSniffingSafetyFeature_LocalComputer_1_var IEProcesses_MimeSniffingSafetyFeature_LocalComputer_1_var 1 0 1 IEProcesses_MimeSniffingSafetyFeature_LocalComputer_2_var IEProcesses_MimeSniffingSafetyFeature_LocalComputer_2_var 1 0 1 IEProcesses_MimeSniffingSafetyFeature_LocalComputer_3_var IEProcesses_MimeSniffingSafetyFeature_LocalComputer_3_var 1 0 1 Internet Explorer Processes - Mime Sniffing Safety Feature - Local Computer MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature CCE-10635-1 CCE-985 MK Protocol Security Restriction - Local Computer MK Protocol Security Restriction - Local Computer IEProcesses_MKProtocolSecurityRestriction_LocalComputer_1_var IEProcesses_MKProtocolSecurityRestriction_LocalComputer_1_var 1 0 1 IEProcesses_MKProtocolSecurityRestriction_LocalComputer_2_var IEProcesses_MKProtocolSecurityRestriction_LocalComputer_2_var 1 0 1 IEProcesses_MKProtocolSecurityRestriction_LocalComputer_3_var IEProcesses_MKProtocolSecurityRestriction_LocalComputer_3_var 1 0 1 Internet Explorer Processes - MK Protocol Security Restriction - Local Computer The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction CCE-10265-7 CCE-591 Protection From Zone Elevation - Local Computer Protection From Zone Elevation - Local Computer IEProcesses_ProtectionFromZoneElevation_LocalComputer_1_var IEProcesses_ProtectionFromZoneElevation_LocalComputer_1_var 1 0 1 IEProcesses_ProtectionFromZoneElevation_LocalComputer_2_var IEProcesses_ProtectionFromZoneElevation_LocalComputer_2_var 1 0 1 IEProcesses_ProtectionFromZoneElevation_LocalComputer_3_var IEProcesses_ProtectionFromZoneElevation_LocalComputer_3_var 1 0 1 Internet Explorer Processes - Protection From Zone Elevation - Local Computer Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet zone, Intranet zone, or Local Machine zone). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation CCE-10574-2 CCE-347 Restrict ActiveX Install - Local Computer Restrict ActiveX Install - Local Computer IEProcesses_RestrictActiveXInstall_LocalComputer_1_var IEProcesses_RestrictActiveXInstall_LocalComputer_1_var 1 0 1 IEProcesses_RestrictActiveXInstall_LocalComputer_2_var IEProcesses_RestrictActiveXInstall_LocalComputer_2_var 1 0 1 IEProcesses_RestrictActiveXInstall_LocalComputer_3_var IEProcesses_RestrictActiveXInstall_LocalComputer_3_var 1 0 1 Internet Explorer Processes - Restrict ActiveX Install - Local Computer The Restrict ActiveX Install\Internet Explorer Processes policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install CCE-10405-9 CCE-119 Restrict File Download - Local Computer Restrict File Download - Local Computer IEProcesses_RestrictFileDownload_LocalComputer_1_var IEProcesses_RestrictFileDownload_LocalComputer_1_var 1 0 1 IEProcesses_RestrictFileDownload_LocalComputer_2_var IEProcesses_RestrictFileDownload_LocalComputer_2_var 1 0 1 IEProcesses_RestrictFileDownload_LocalComputer_3_var IEProcesses_RestrictFileDownload_LocalComputer_3_var 1 0 1 Internet Explorer Processes - Restrict File Download - Local Computer In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict File Download CCE-10578-3 CCE-668 Scripted Window Security Restrictions - Local Computer Scripted Window Security Restrictions - Local Computer IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_1_var IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_1_var 1 0 1 IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_2_var IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_2_var 1 0 1 IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_3_var IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_3_var 1 0 1 Internet Explorer Processes - Scripted Window Security Restrictions - Local Computer Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions CCE-10604-7 CCE-827 Security Patches Securing a given computer has become increasingly important. As such, it is essential to keep a host up to current patch levels to eliminate known vulnerabilities and weaknesses. In conjunction with antivirus software and a personal firewall, patching goes a long way to securing a host against outside attacks and exploitation. Microsoft provides two mechanisms for distributing security updates: Automatic Updates and Microsoft Update. In smaller environments, either method may be sufficient for keeping systems current with patches. Other environments typically have a software change management control process or a patch management program that tests patches before deploying them; distribution may then occur through local Windows Update Services (WUS) or Windows Server Update Services (WSUS) servers, which provide approved security patches for use by the Automatic Updates feature. Security Patches Up-To-Date Keep systems up to current patch levels to eliminate known vulnerabilities and weaknesses. National Institute of Standards and Technology 5.4 2011-01-24T14:00:00.000-05:00 Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options and General tab. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The Do not allow users to enable or disable add-ons policy setting allows you to manage whether users have the ability to allow or deny add-ons through Manage Add-ons. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The Make proxy settings per – machine (rather than per-user) setting ensures proxy settings for all users of the same computer are the same. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP). Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The Security Zones: Do not allow users to add/delete sites setting prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The Security Zones: Do not allow users to change policies setting prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level. If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Microsoft ActiveX controls and file downloads often have digital signatures attached that vouch for both the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure that unmodified. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such as toolbars. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage software channel permissions. If you enable this policy setting, you can choose the following options from the drop-down box. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Internet Zone\Turn Off First- Run Opt-In Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The 'Turn on Protected Mode' setting should be configured correctly for the Internet Zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The 'Download signed ActiveX controls' setting should be configured correctly for the Locked-Down Internet Zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether script code on pages in the zone is run. If you enable this policy setting, script code on pages in the zone can run automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. 03-21-2007 - Jon Baker - based on guidance received to date I have modified this definition to result in true if the specified registry key has a value of 0 or does not exist. At some point the variable associated with check of the registry key value should be removed since it may no longer be needed. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. If you enable this policy setting, controls and plug-ins can run without user intervention. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage software channel permissions. If you enable this policy setting, you can choose the following options from the drop-down box. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Computer Configuration\Network\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Turn Off First- Run Opt-In Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The 'Turn on Protected Mode' setting should be configured correctly for the Restricted Sites Zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This setting specifies the update check interval. The default value is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. This policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension. If you enable this policy setting, Internet Explorer requires consistent MIME data for all received files. If you disable this policy setting, Internet Explorer will not require consistent MIME data for all received files. If you do not configure this policy setting, Internet Explorer requires consistent MIME data for all received files. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet zone, Intranet zone, or Local Machine zone). Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 The Restrict ActiveX Install\Internet Explorer Processes policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows the user to enable the SmartScreen Filter, which will warn if the Web site being visited is known for fraudulent attempts to gather personal information through 'phishing,' or is known to host malware. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy controls the Web site compatibility lists provided by Microsoft. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 Delete Browsing History on exit automatically deletes specified items when the last browser windows closes. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting prevents users from deleting the history of webs sites the user has visited. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to disable the InPrivate Browsing feature. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether a page may control embedded WebBrowser Controls via script Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the 'Open File - Security Warning' prompt is shown when launching executables or other unsafe files. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether a page may control embedded WebBrowser Controls via script Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the 'Open File - Security Warning' prompt is shown when launching executables or other unsafe files. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control. Microsoft Windows XP Microsoft Windows Vista Microsoft Windows 7 Microsoft Internet Explorer 8 This policy setting controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injection into Web sites in this zone. Microsoft Windows XP Microsoft Windows Server 2003 Microsoft Windows Vista Microsoft Windows Server 2008 Microsoft Windows 7 A version of Microsoft Internet Explorer 8 is installed.