Detections
Analytics

18.9.85.3 Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting controls whether Web-based programs are allowed to install software on the computer without notifying the user.

The recommended state for this setting is: 'Disabled'.

Rationale:
Suppressing the system warning can pose a security risk and increase the attack surface on the system.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Disabled':


Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer\Prevent Internet Explorer security prompt for Windows Installer scripts


Note: This Group Policy path is provided by the Group Policy template 'MSI.admx/adml' that is included with all versions of the Microsoft Windows Administrative Templates.

Note #2: In older Microsoft Windows Administrative Templates, this setting was initially named _Disable IE security prompt for Windows Installer scripts_, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative Templates.

Impact:
None - this is the default behavior.

See Also

https://workbench.cisecurity.org/files/1937

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-11(1), CSCv6|7

Plugin: Windows

Control ID: 67be62be1b91cceb290b1fdb8173f028eab49b2cbe5a3a04de7b84c26c270ef9