Detections
Analytics

1.35 Set 'When executing a custom action:' to 'Enabled:Automatically Deny'

Information

This policy setting controls whether Outlook prompts users before executing a custom
action. Custom actions add functionality to Outlook that can be triggered as part of a rule.
Among other possible features, custom actions can be created that reply to messages in
ways that circumvent the Outlook model's programmatic send protections.
If you enable this policy setting, you can choose from four options to control how Outlook
functions when a custom action is executed that uses the Outlook object model-

. Prompt User
. Automatically Approve
. Automatically Deny
. Prompt user based on computer security. This option enforces the default
configuration in Outlook.

If you disable or do not configure this policy setting, when Outlook or another program
initiates a custom action using the Outlook object model, users are prompted to allow or
reject the action. If this configuration is changed, malicious code can use the Outlook object
model to compromise sensitive information or otherwise cause data and computing
resources to be at risk. This is the equivalent of choosing Enabled -- Prompt user based on
computer security. The recommended state for this setting is- Enabled-Automatically
Deny.

*Rationale*

Custom actions add functionality to Outlook 2010 that can be triggered as part of a rule.
Among other possible features, custom actions can be created that reply to messages in
ways that circumvent the Outlook model's programmatic send protections.
By default, when Outlook or another program initiates a custom action using the Outlook
object model, users are prompted to allow or reject the action. If this configuration is
changed, malicious code can use the Outlook object model to compromise sensitive
information or otherwise cause data and computing resources to be at risk.

Solution

To implement the recommended configuration state, set the following Group Policy setting
to Enabled.


User Configuration\Administrative Templates\Microsoft Outlook 2010\Security\Security
Form Settings\Custom Form Security\Set Outlook object model custom actions execution
prompt\Set Outlook object model custom actions execution prompt

Then set the When executing a custom action- option to Automatically Deny.

Impact-Configuring this setting to 'Automatically Deny' prevents Outlook 2010 from executing any
custom actions that use the Outlook object model. If your users rely on any such actions,
you may have to find alternate methods for providing this functionality.

See Also

https://workbench.cisecurity.org/files/530

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b.

Plugin: Windows

Control ID: 5a3f3edaee45fbec0a4b972b314970d10dea87890f16dddc1a51c32bbdf5a65e