UCF STIG Viewer Logo

Initialize and script ActiveX controls not marked as safe for internet zone is not disabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-6245 DTBI024 SV-16443r1_rule DCMC-1 Medium
Description
This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option. If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted. If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted. If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
STIG Date
Microsoft IE Version 7 2015-12-17

Details

Check Text ( C-14676r1_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable" selected from down drop box.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Criteria: If the value 1201 is REG_DWORD = 3, this is not a finding.
Fix Text (F-15231r1_fix)
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable" selected from down drop box.

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Criteria: Set the value 1201 to REG_DWORD = 3.