Detections
Analytics

18.9.8.2 Ensure 'Set the default behavior for AutoRun' is set to 'Enabled: Do not execute any autorun commands'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting sets the default behavior for Autorun commands. Autorun commands are generally stored in autorun.inf files. They often launch the installation program or other routines.

The recommended state for this setting is: Enabled: Do not execute any autorun commands.

Rationale:

Prior to Windows Vista, when media containing an autorun command is inserted, the system will automatically execute the program without user intervention. This creates a major security concern as code may be executed without user's knowledge. The default behavior starting with Windows Vista is to prompt the user whether autorun command is to be run. The autorun command is represented as a handler in the Autoplay dialog.

Impact:

AutoRun commands will be completely disabled.

Solution

To establish the recommended configuration, set the following Device Configuration Policy to Enabled: Do not execute any autorun commands:

To access the Device Configuration Policy from the Intune Home page:

Click Devices

Click Configuration profiles

Click Create profile

Select the platform (Windows 10 and later)

Select the profile (Administrative Templates)

Click Create

Enter a Name

Click Next

Configure the following Setting

Path: Computer Configuration/Windows Components/AutoPlay Policies
Setting Name: Set the default behavior for AutoRun
Configuration: Enabled: Do not execute any autorun commands

Select OK

Continue through the Wizard to complete the creation of the profile (profile assignments, applicability etc.)

Note: More than one configuration setting from each of the Configuration profiles (ex: Administrative Templates, Custom etc.) can be added to each Device Configuration Policy.

Default Value:

Disabled. (Windows will prompt the user whether autorun command is to be run.)

See Also

https://workbench.cisecurity.org/files/4291

Item Details

References: CSCv7|8.5

Plugin: Windows

Control ID: bd4c5a5948097e9c0e8fa15f04e42f88c0db2eef00928ca013b9776bdd508d3b