Turn on the auto-complete feature for user names and passwords on forms are not disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15581	DTBI725	SV-25670r1_rule	ECSC-1	Medium

Description
This AutoComplete feature can remember and suggest User names and passwords on Forms. If you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select "prompt me to save passwords". If you disable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords. If you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button.

Description

This AutoComplete feature can remember and suggest User names and passwords on Forms. If you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select "prompt me to save passwords". If you disable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords. If you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button.

STIG	Date
Internet Explorer 8 STIG	2012-11-29

Details

Check Text ( C-27149r1_chk )
The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on the auto-complete feature for user names and passwords on forms" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value FormSuggest Passwords is REG_SZ = no, this is not a finding. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value FormSuggest Passwords is REG_DWORD = 1, this is not a finding.

Check Text ( C-27149r1_chk )

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on the auto-complete feature for user names and passwords on forms" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value FormSuggest Passwords is REG_SZ = no, this is not a finding. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: If the value FormSuggest Passwords is REG_DWORD = 1, this is not a finding.

Fix Text (F-23247r1_fix)
The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on the auto-complete feature for user names and passwords on forms" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value FormSuggest Passwords to REG_SZ = no. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value FormSuggest Passwords to REG_DWORD = 1.

Fix Text (F-23247r1_fix)

The policy value for User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> "Turn on the auto-complete feature for user names and passwords on forms" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value FormSuggest Passwords to REG_SZ = no. HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value FormSuggest Passwords to REG_DWORD = 1.