Detections
Analytics

1.3.1 Ensure 'Allow users to manage installed CA certificates' is set to 'Enabled: Disallow users from managing certificates'

Information

This policy configures the level of access users have when managing CA certificates in Microsoft Edge.

The recommended state for this setting is: Enabled: Disallow users from managing certificates.

Configuring this policy to the recommended state prevents users from unknowingly installing certificates that grant excessive trust, such as root CAs from unverified sources. It also prevents system-trusted certificates from being tampered with by users.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Disallow users from managing certificates :

Computer Configuration\Administrative Templates\Microsoft Edge\Certificate management settings\Allow users to manage installed CA certificates

Note: This Group Policy path may not exist by default. It is provided by the Group Policy template MSEdge.admx/adml that can be downloaded from: Download Microsoft Edge for Business - Microsoft https://www.microsoft.com/en-us/edge/business/download.

Impact:

Users will not be able to manage certificates.

See Also

https://workbench.cisecurity.org/benchmarks/28120

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6

Plugin: Windows

Control ID: 97da8956737759befb4736ce95eba024d6b06dc4570b92e4a58f694287b1c5f5