Detections
Analytics

3.1.1 (L1) Ensure 'Update policy override default' is set to 'Enabled: Automatic silent updates only' or Higher

Information

This policy settings sets the default behavior for all channels concerning the way Microsoft Edge Update handles available updates for Microsoft Edge.

The recommended state for this setting is: Enabled: Always allow updates (recommended) or Enabled: Automatic silent updates only.

Note: This setting can be overridden for individual channels by specifying the Update policy override policy for those specific channels.

Note #2: This policy is available only on Windows instances that are joined to a Microsoft(R) Active Directory(R) domain.

Applying software updates as soon as they become available can ensure that systems will always have the most recent critical updates installed.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Enabled: Always allow updates (recommended) or Enabled: Automatic silent updates only :

Microsoft Edge Update\Applications\Update policy override default

Impact:

The latest Microsoft Edge updates are automatically installed. Enterprises that use other means of patching systems will need to exclude this recommendation from the benchmark.

See Also

https://workbench.cisecurity.org/benchmarks/24642

Item Details

Category: RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|RA-5, 800-53|SI-2, 800-53|SI-2(2), CSCv7|3.5

Plugin: Windows

Control ID: 8b0d95e08575d051c2e4198a7b34ffc9d1a02accd9a9356163d5eda459d69cf9