2.3.18.1 Ensure 'Allow users with earlier versions of Office to read with browsers...' is set to 'Disabled'

Information

This policy setting will allow users with earlier versions of Office to read documents with browsers supporting Information Rights Management.

The recommended state for this setting is: Disabled.

Rationale:

The Windows Rights Management Add-on for Internet Explorer provides a way for users who do not use the Office release to view, but not alter, files with restricted permissions. By default, IRM-enabled files are saved in a format that cannot be viewed by using the Windows Rights Management Add-on. If this setting is enabled, an embedded rights-managed HTML version of the content is saved with each IRM-enabled file, which can be viewed in Internet Explorer using the add-on. This configuration increases the size of rights-managed files, in some cases significantly.

Impact:

Disabling this setting enforces the default configuration, and is therefore unlikely to cause significant usability issues for most users.

Solution

To establish the recommended configuration via GP, set the following UI path to Disabled:

User Configuration\Administrative Templates\Microsoft Office 2016\Manage Restricted Permissions\Allow users with earlier versions of Office to read with browsers....

Default Value:

Disabled. (Enforce defaults.)

See Also

https://workbench.cisecurity.org/benchmarks/12129

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3

Plugin: Windows

Control ID: 716dcc4fe251111fb89955c89596ad094f956123c52672102074a3676e615eb8