2.6.6.6.2.6 Ensure 'Require That application add-ins are signed by Trusted Publisher' is set to 'Enabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This policy setting controls whether add-ins for this application must be digitally signed by a trusted publisher.

The recommended state for this setting is: Enabled.

Rationale:

By default, Office applications do not check the digital signature on application add-ins before opening them. Not configuring this setting may allow an application to load dangerous add-ins and as a result, malicious code could become active on endpoints or the network.

Impact:

This setting could cause disruptions for users who rely on add-ins that are not signed by trusted publishers. These users will either have to obtain signed versions of such add-ins or stop using them.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled.

User Configuration\Administrative Templates\Microsoft PowerPoint 2016\PowerPoint Options\Security\Trust Center\Require That Application Add-ins are Signed by Trusted Publisher

Default Value:

Disabled. (This application does not check the digital signature on application add-ins before opening them.)

Additional Information:

Office stores certificates for trusted publishers in the Internet Explorer trusted publisher store. Earlier versions of Office stored trusted publisher certificate information (specifically, the certificate thumbprint) in a special Office trusted publisher store. Office still reads trusted publisher certificate information from the Office trusted publisher store, but does not write information to this store.

Therefore, if you created a list of trusted publishers in a previous version of Office and you upgrade to the Office release, your trusted publisher list will still be recognized. However, any trusted publisher certificates that you add to the list will be stored in the Internet Explorer trusted publisher store.

See Also

https://workbench.cisecurity.org/files/4234