18.9.8.3 (L1) Ensure 'Turn off Autoplay' is set to 'Enabled: All drives'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Autoplay starts to read from a drive as soon as you insert media in the drive, which causes the setup file for programs or audio media to start immediately. An attacker could use this feature to launch a program to damage the computer or data on the computer. Autoplay is disabled by default on some removable drive types, such as floppy disk and network drives, but not on CD-ROM drives.
Note: You cannot use this policy setting to enable Autoplay on computer drives in which it is disabled by default, such as floppy disk and network drives.
The recommended state for this setting is: Enabled: All drives.

Rationale:
An attacker could use this feature to launch a program to damage a client computer or data on the computer.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: All drives:
Computer Configuration\Policies\Administrative Templates\Windows Components\AutoPlay Policies\Turn off Autoplay
Note: This Group Policy path is provided by the Group Policy template AutoPlay.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.

Impact:
Autoplay will be disabled - users will have to manually launch setup or installation programs that are provided on removable media.

Default Value:
Disabled. (Autoplay is enabled.)

References:
1. CCE-33791-5

See Also

https://workbench.cisecurity.org/files/2754