Security Warning for unsafe files must be set to prompt (Internet zone).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22154	DTBI820	SV-45306r1_rule	ECSC-1	Medium

Description
This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.

Description

This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file shared by using Windows Explorer, for example). If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open. If you disable this policy these files do not open. If you do not configure this policy setting, the user can configure how the computer handles these files.

STIG	Date
Microsoft Internet Explorer 10 Security Technical Implementation Guide	2015-12-16

Details

Check Text ( C-42654r1_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Show security warning for potentially unsafe files" must be "Enabled", and "Prompt" selected from the drop-down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1806 is REG_DWORD = 1, this is not a finding.

Check Text ( C-42654r1_chk )

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Show security warning for potentially unsafe files" must be "Enabled", and "Prompt" selected from the drop-down box.

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Criteria: If the value 1806 is REG_DWORD = 1, this is not a finding.

Fix Text (F-38702r1_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page -> Internet Zone -> "Show security warning for potentially unsafe files" to "Enabled", and select "Prompt" from the drop-down box.