| DTBI370 | Medium | Checking for signatures on downloaded programs must be enforced. | This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it has not been modified or... |
| DTBI375 | Medium | All network paths (UNCs) for Intranet sites must be disallowed. | Some UNC paths could refer to servers not managed by the organization, which means they could host malicious content; and therefore, it is safest to not include all UNC paths in the Intranet Sites... |
| DTBI766 | Medium | Microsoft services to provide enhanced suggestions as the user types in the Address bar must be disallowed. | This policy setting allows Internet Explorer to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user's keystrokes are sent to Microsoft... |
| DTBI765 | Medium | Suggested Sites functionality must be disallowed. | This policy setting controls the Suggested Sites feature, which recommends sites based on the user's browsing activity. Suggested Sites reports a user's browsing history to Microsoft to store and... |
| DTBI760 | Medium | Browser must retain history on exit. | Delete Browsing History on exit automatically deletes specified items when the last browser window closes. Disabling this function will prevent users from deleting their browsing history, which... |
| DTBI495 | Medium | Pop-up Blocker must be enforced (Internet zone). | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting,... |
| DTBI1010 | Medium | Internet Explorer Processes Restrict ActiveX Install must be enforced (Explorer). | Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to... |
| DTBI650 | Medium | .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Restricted Sites Zone). | This policy setting allows you to manage whether .NET Framework reliant components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed... |
| DTBI018 | Medium | Check for publishers certificate revocation must be enforced. | Check for publisher's certificate revocation options should be enforced to ensure all PKI signed objects are validated. |
| DTBI655 | Medium | .NET Framework-reliant components signed with Authenticode must be disallowed to run (Restricted Sites Zone). | This policy setting allows you to manage whether .NET Framework reliant components that are signed with Authenticode can be executed from Internet Explorer. It may be possible for malicious... |
| DTBI870 | Medium | Security Warning for unsafe files must be disallowed (Restricted Sites zone). | This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file... |
| DTBI015 | Medium | The Internet Explorer warning about certificate address mismatch must be enforced. | This parameter warns users if the certificate being presented by the website is invalid. Since server certificates are used to validate the identity of the web server it is critical to warn the... |
| DTBI014 | Medium | The Internet Explorer SSL/TLS parameter must be set correctly. | This parameter ensures only DoD-approved ciphers and algorithms are enabled for use by the web browser. TLS and SSL are protocols for protecting communications between the browser and the target... |
| DTBI010 | Medium | First Run Wizard settings must be established for a home page. | This policy setting prevents Internet Explorer from running the First Run Wizard the first time a user starts the browser after installing Internet Explorer or Windows. If this policy setting is... |
| DTBI575 | Medium | Allow binary and script behaviors must be disallowed (Restricted Sites zone). | This policy setting allows you to manage dynamic binary and script behaviors of components that encapsulate specific functionality for HTML elements, to which they were attached. If you enable... |
| DTBI775 | Medium | Automatic checking for Internet Explorer updates must be disallowed. | This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days,... |
| DTBI980 | Medium | Ability to install new versions of Internet Explorer automatically must be disallowed. | This policy setting configures Internet Explorer to automatically install new versions of Internet Explorer when they are available. If you enable this policy setting, automatic upgrade of... |
| DTBI770 | Medium | Deleting websites that the user has visited must be disallowed. | This policy prevents users from deleting the history of websites the user has visited. If you enable this policy setting, websites the user has visited will be preserved when the user clicks... |
| DTBI985 | Medium | When enhanced protected mode is enabled, ActiveX controls must be disallowed to run in protected mode. | This setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced... |
| DTBI1020 | Medium | Internet Explorer Processes Restrict ActiveX Install must be enforced (IExplore). | Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to... |
| DTBI470 | Medium | MIME sniffing must be disallowed (Restricted Sites zone). | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type... |
| DTBI475 | Medium | First-Run prompt ability must be disallowed (Internet zone). | This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be... |
| DTBI1025 | Medium | Dragging of content from different domains within a window must be disallowed (Restricted Sites zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting,... |
| DTBI136 | Medium | Logon options must be configured and enforced (Restricted Sites zone). | Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user... |
| DTBI640 | Medium | Internet Explorer Processes for Restrict File Download must be enforced (IExplore). | In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they... |
| DTBI485 | Medium | Protected Mode must be enforced (Internet zone). | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy... |
| DTBI860 | Medium | When uploading files to a server, the local directory path must be excluded (Restricted Sites zone). | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be... |
| DTBI645 | Medium | Internet Explorer Processes for restricting pop-up windows must be enforced (Reserved). | Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force... |
| DTBI480 | Medium | First-Run prompt ability must be disallowed (Restricted Sites zone). | This policy setting controls the First Run response that users see on a zone-by-zone basis. When a user encounters a new control that has not previously run in Internet Explorer, they may be... |
| DTBI647 | Medium | Internet Explorer Processes for restricting pop-up windows must be enforced (Explorer). | Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a... |
| DTBI649 | Medium | Internet Explorer Processes for restricting pop-up windows must be enforced (IExplore). | Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable websites will resize windows to either hide other windows or force a... |
| DTBI900 | Medium | Internet Explorer Processes Restrict ActiveX Install must be enforced (Reserved). | Users often choose to install software such as ActiveX controls that are not permitted by their organization's security policy. Such software can pose significant security and privacy risks to... |
| DTBI061 | Medium | Java permissions must be configured with High Safety (Intranet zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down... |
| DTBI062 | Medium | Antimalware programs against ActiveX controls must not be run for the Intranet zone. | This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting,... |
| DTBI580 | Medium | Automatic prompting for file downloads must be disallowed (Restricted Sites zone). | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated... |
| DTBI990 | Medium | Dragging of content from different domains across windows must be disallowed (Internet zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy... |
| DTBI740 | Medium | Managing SmartScreen Filter use must be enforced. | This setting is important from a security perspective because Microsoft has extensive data illustrating the positive impact the SmartScreen filter has had on reducing the risk of malware infection... |
| DTBI745 | Medium | Add-on performance notifications must be disallowed. | This policy setting prevents Internet Explorer from displaying a notification when the average time it takes to load all the user's enabled add-ons exceeds the threshold. The notification informs... |
| DTBI995 | Medium | Enhanced protected mode functionality must be enforced. | Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced... |
| DTBI500 | Medium | Pop-up Blocker must be enforced (Restricted Sites zone). | This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting,... |
| DTBI1035 | Medium | Displaying of the reveal password button must be disallowed. | This policy setting allows you to hide the reveal password button when Internet Explorer prompts users for a password. The reveal password button is displayed during password entry. When the user... |
| DTBI1030 | Medium | URL Suggestions must be disallowed. | This policy setting turns off URL Suggestions. URL Suggestions allow users to auto complete URLs in the address bar based on common URLs. The list of common URLs is stored locally and is updated... |
| DTBI599 | Medium | Internet Explorer Processes for MK protocol must be enforced (Reserved). | The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information... |
| DTBI715 | Medium | Crash Detection management must be enforced. | The 'Turn off Crash Detection' policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. A crash report could contain sensitive information from... |
| DTBI850 | Medium | Scripting of Internet Explorer WebBrowser control must be disallowed (Restricted Sites zone). | This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you... |
| DTBI340 | Medium | Active content from CDs must be disallowed to run on user machines. | This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run... |
| DTBI910 | Medium | Status bar updates via script must be disallowed (Internet zone). | This policy setting allows you to manage whether script is allowed to update the status bar within the zone. A script running in the zone could cause false information to be displayed on the... |
| DTBI129 | Medium | Navigating windows and frames across different domains must be disallowed (Restricted Sites zone). | Frames navigating across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is... |
| DTBI670 | Medium | Scripting of Java applets must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user... |
| DTBI455 | Medium | XAML files must be disallowed (Internet zone). | These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the... |
| DTBI325 | Medium | Security checking features must be enforced. | This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. If you enable this... |
| DTBI614 | Medium | Internet Explorer Processes for Zone Elevation must be enforced (IExplore). | Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a... |
| DTBI450 | Medium | Java permissions must be disallowed (Locked Down Restricted Sites zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for... |
| DTBI320 | Medium | Internet Explorer must be configured to use machine settings. | Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser.... |
| DTBI594 | Medium | Internet Explorer Processes for MIME handling must be enforced (IExplore). | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet... |
| DTBI595 | Medium | Internet Explorer Processes for MIME sniffing must be enforced (Reserved). | MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting... |
| DTBI596 | Medium | Internet Explorer Processes for MIME sniffing must be enforced (Explorer). | MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting... |
| DTBI597 | Medium | Internet Explorer Processes for MIME sniffing must be enforced (IExplore). | MIME sniffing is the process of examining the content of a MIME file to determine its context - whether it is a data file, an executable file, or some other type of file. This policy setting... |
| DTBI590 | Medium | Internet Explorer Processes for MIME handling must be enforced. (Reserved) | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet... |
| DTBI612 | Medium | Internet Explorer Processes for Zone Elevation must be enforced (Explorer). | Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a... |
| DTBI592 | Medium | Internet Explorer Processes for MIME handling must be enforced (Explorer). | Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a web server. The Consistent MIME Handling\Internet... |
| DTBI610 | Medium | Internet Explorer Processes for Zone Elevation must be enforced (Reserved). | Internet Explorer places restrictions on each web page it opens that are dependent upon the location of the web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a... |
| DTBI515 | Medium | Websites in less privileged web content zones must be prevented from navigating into the Internet zone. | This policy setting allows a user to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Internet zone. If this policy setting is enabled, web sites... |
| DTBI690 | Medium | AutoComplete feature for forms must be disallowed. | This AutoComplete feature suggests possible matches when users are filling in forms. It is possible that this feature will cache sensitive data and store it in the user's profile, where it might... |
| DTBI755 | Medium | Browser Geolocation functionality must be disallowed. | This setting has a small impact on user privacy because users may unknowingly allow their browser to share location data with web sites that they visit. The value of enabling this setting is... |
| DTBI001 | Medium | The IE home page must be set to blank or a trusted site. | By setting this parameter inappropriately, a malicious web site will be automatically loaded into a browser which may contain mobile code. |
| DTBI920 | Medium | .NET Framework-reliant components not signed with Authenticode must be disallowed to run (Internet zone). | Unsigned components are more likely to contain malicious code and it is more difficult to determine the author of the application - therefore they should be avoided if possible. This policy... |
| DTBI1040 | Medium | Do Not Track header must be sent. | This policy setting allows you to configure how Internet Explorer sends the Do Not Track (DNT) header. If you enable this policy setting, Internet Explorer sends the DNT:1 header on all HTTP and... |
| DTBI1045 | Medium | Legacy filter functionality must be disallowed (Internet zone). | This policy setting specifies whether Internet Explorer renders legacy visual filters in this zone. If you enable this policy setting, you can control whether or not Internet Explorer renders... |
| DTBI1046 | Medium | Antimalware programs against ActiveX controls must not be run for the Internet zone. | This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting,... |
| DTBI120 | Medium | Font downloads must be disallowed (Restricted Sites zone). | It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the font. Downloads of fonts can sometimes contain malicious... |
| DTBI350 | Medium | Software must be disallowed to run or install with invalid signatures. | Microsoft ActiveX controls and file downloads often have digital signatures attached that certify the file's integrity and the identity of the signer (creator) of the software. Such signatures... |
| DTBI356 | Medium | The 64-bit tab processes, when running in Enhanced Protected Mode on 64-bit versions of Windows, must be turned on. | This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on... |
| DTBI355 | Medium | Third-party browser extensions must be disallowed. | This policy setting allows you to manage whether Internet Explorer will launch COM add-ons, known as browser helper objects such as toolbars. Browser helper objects may contain flaws such as... |
| DTBI840 | Medium | Cross-Site Scripting (XSS) Filter must be enforced (Internet zone). | The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter... |
| DTBI440 | Medium | Java permissions must be disallowed (Locked Down Trusted Sites zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down... |
| DTBI445 | Medium | Java permissions must be disallowed (Locked Down Internet zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for... |
| DTBI605 | Medium | Internet Explorer Processes for MK protocol must be enforced (IExplore). | The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information... |
| DTBI126 | Medium | Functionality to drag and drop or copy and paste files must be disallowed (Restricted Sites zone). | Content hosted on sites located in the Restricted Sites zone are more likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and... |
| DTBI600 | Medium | Internet Explorer Processes for MK protocol must be enforced (Explorer). | The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older web applications use the MK protocol to retrieve information... |
| DTBI520 | Medium | Websites in less privileged web content zones must be prevented from navigating into the Restricted Sites zone. | This policy setting allows you to manage whether websites from less privileged zones, such as Restricted Sites, can navigate into the Restricted zone. If this policy setting is enabled, websites... |
| DTBI680 | Medium | The update check interval must be configured and set to 30 days. | Although Microsoft thoroughly tests all patches and service packs before they are published, organizations should carefully control all of the software that is installed on their managed... |
| DTBI725 | Medium | Turn on the auto-complete feature for user names and passwords on forms must be disabled. | This policy setting controls automatic completion of fields in forms on web pages. It is possible that malware could be developed which would be able to extract the cached user names and passwords... |
| DTBI930 | Medium | .NET Framework-reliant components signed with Authenticode must be disallowed to run (Internet zone). | It may be possible for someone to host malicious content on a website that takes advantage of these components. This policy setting allows you to manage whether .NET Framework components that are... |
| DTBI1051 | Medium | Antimalware programs against ActiveX controls must not be run for the Restricted Sites zone. | This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting,... |
| DTBI1050 | Medium | Legacy filter functionality must be disallowed (Restricted Sites zone). | This policy setting specifies whether Internet Explorer renders legacy visual filters in this zone. If you enable this policy setting, you can control whether or not Internet Explorer renders... |
| DTBI1055 | Medium | Internet Explorer accelerator functionality must be disallowed. | The Internet Explorer Accelerator feature is for use with third-party applications and toolbars. This policy setting allows you to manage whether users can access accelerators. If you enable this... |
| DTBI112 | Medium | The Download signed ActiveX controls property must be disallowed (Restricted Sites zone). | ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to determine... |
| DTBI113 | Medium | The Download unsigned ActiveX controls property must be disallowed (Restricted Sites zone). | Unsigned code is potentially harmful, especially when coming from an untrusted zone. ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from trusted... |
| DTBI114 | Medium | The Initialize and script ActiveX controls not marked as safe property must be disallowed (Restricted Sites zone). | ActiveX controls not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked... |
| DTBI115 | Medium | ActiveX controls and plug-ins must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. ActiveX controls not marked as safe should not be executed. If you... |
| DTBI116 | Medium | ActiveX controls marked safe for scripting must be disallowed (Restricted Sites zone). | This policy setting allows management of whether ActiveX controls marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur... |
| DTBI119 | Medium | File downloads must be disallowed (Restricted Sites zone). | Sites located in the Restricted Sites Zone are more likely to contain malicious payloads and therefore downloads from this zone should be blocked. Files should not be able to be downloaded from... |
| DTBI830 | Medium | ActiveX controls without prompt property must be used in approved domains only (Internet zone). | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable... |
| DTBI835 | Medium | Internet Explorer Processes for Notification Bars must be enforced (IExplore). | This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is... |
| DTBI300 | Medium | Configuring History setting must be set to 40 days. | This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet... |
| DTBI305 | Medium | Automatic configuration of Internet Explorer connections must be disallowed. | This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet Explorer use the... |
| DTBI630 | Medium | Internet Explorer Processes for Restrict File Download must be enforced (Reserved). | In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they... |
| DTBI635 | Medium | Internet Explorer Processes for Restrict File Download must be enforced (Explorer). | In certain circumstances, websites can initiate file download prompts without interaction from users. This technique can allow websites to put unauthorized files on users' hard drives if they... |
| DTBI435 | Medium | Java permissions must be disallowed (Locked Down Intranet zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down... |
| DTBI430 | Medium | Java permissions must be disallowed (Locked Down Local Machine zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down... |
| DTBI046 | Medium | Logon options must be configured to prompt (Internet zone). | Users could submit credentials to servers operated by malicious individuals who could then attempt to connect to legitimate servers with those captured credentials. Care must be taken with user... |
| DTBI044 | Medium | Clipboard operations via script must be disallowed (Internet zone). | A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious... |
| DTBI042 | Medium | Userdata persistence must be disallowed (Internet zone). | Userdata persistence must have level of protection based upon the site being accessed. It is possible for sites hosting malicious content to exploit this feature as part of an attack against... |
| DTBI128 | Medium | Launching programs and files in IFRAME must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME... |
| DTBI940 | Medium | Scriptlets must be disallowed (Restricted Sites zone). | This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy... |
| DTBI820 | Medium | Security Warning for unsafe files must be set to prompt (Internet zone). | This policy setting controls whether or not the 'Open File - Security Warning' message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file... |
| DTBI127 | Medium | Installation of desktop items must be disallowed (Restricted Sites zone). | Active Desktop items could contain links to unauthorized websites or other undesirable content. It is prudent to prevent users from installing desktop items from this security zone. Installation... |
| DTBI675 | Medium | The URL to be displayed for checking updates to Internet Explorer and Internet Tools must be blank or empty. | This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. If you enable this policy setting, users will not be able to... |
| DTBI121 | Medium | Java permissions must be disallowed (Restricted Sites zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for... |
| DTBI825 | Medium | Internet Explorer Processes for Notification Bars must be enforced (Explorer). | This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is... |
| DTBI123 | Medium | The Allow META REFRESH property must be disallowed (Restricted Sites zone). | It is possible that users will unknowingly be redirected to a site hosting malicious content. 'Allow META REFRESH' must have a level of protection based upon the site being browsed. This policy... |
| DTBI122 | Medium | Accessing data sources across domains must be disallowed (Restricted Sites zone). | The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. This policy setting allows you to manage whether Internet... |
| DTBI318 | Medium | Internet Explorer must be set to disallow users to add/delete sites. | This setting prevents users from adding sites to various security zones. Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the... |
| DTBI319 | Medium | Internet Explorer must be configured to disallow users to change policies. | Users who change their Internet Explorer security settings could enable the execution of dangerous types of code from the Internet and websites listed in the Restricted Sites zone in the browser.... |
| DTBI315 | Medium | Participation in the Customer Experience Improvement Program must be disallowed. | This setting controls whether users can participate in the Microsoft Customer Experience Improvement Program to help improve Microsoft applications. When users choose to participate in the... |
| DTBI425 | Medium | Java permissions must be disallowed (Local Machine zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down... |
| DTBI426 | Medium | Antimalware programs against ActiveX controls must not be run for the Local Machine zone. | This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting,... |
| DTBI890 | Medium | Cross-Site Scripting (XSS) Filter property must be enforced (Restricted Sites zone). | The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure. This setting controls if the Cross-Site Scripting (XSS) Filter... |
| DTBI815 | Medium | Internet Explorer Processes for Notification Bars must be enforced (Reserved). | This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification Bar is... |
| DTBI810 | Medium | When uploading files to a server, the local directory path must be excluded (Internet zone). | This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form. If the local path information is sent, some information may be... |
| DTBI460 | Medium | XAML files must be disallowed (Restricted Sites zone). | These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the... |
| DTBI465 | Medium | MIME sniffing must be disallowed (Internet zone). | This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type... |
| DTBI032 | Medium | Accessing data sources across domains must be disallowed (Internet zone). | The ability to access data zones across domains could cause the user to unknowingly access content hosted on an unauthorized server. Access to data sources across multiple domains must be... |
| DTBI031 | Medium | The Java permissions must be disallowed (Internet zone). | Java applications could contain malicious code; sites located in this security zone are more likely to be hosted by malicious individuals. This policy setting allows you to manage permissions for... |
| DTBI030 | Medium | Font downloads must be disallowed (Internet zone). | Downloads of fonts can sometimes contain malicious code. It is possible that a font could include malformed data that would cause Internet Explorer to crash when it attempts to load and render the... |
| DTBI950 | Medium | Status bar updates via script must be disallowed (Restricted Sites zone). | A script running in the zone could cause false information to be displayed on the status bar, which could confuse the user and cause an undesirable action. This policy setting allows you to manage... |
| DTBI036 | Medium | Functionality to drag and drop or copy and paste files must be disallowed (Internet zone). | Content hosted on sites located in the Internet zone are likely to contain malicious payloads and therefore this feature should be blocked for this zone. Drag and drop or copy and paste files must... |
| DTBI132 | Medium | Userdata persistence must be disallowed (Restricted Sites zone). | Userdata persistence must have a level of protection based upon the site being accessed. This policy setting allows you to manage the preservation of information in the browser's history, in... |
| DTBI133 | Medium | Active scripting must be disallowed (Restricted Sites Zone). | Active scripts hosted on sites located in this zone are more likely to contain malicious code. Active scripting must have a level of protection based upon the site being accessed. This policy... |
| DTBI039 | Medium | Navigating windows and frames across different domains must be disallowed (Internet zone). | Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site. It is... |
| DTBI038 | Medium | Launching programs and files in IFRAME must be disallowed (Internet zone). | This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. Launching of programs in IFRAME... |
| DTBI385 | Medium | Script-initiated windows without size or position constraints must be disallowed (Internet zone). | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions... |
| DTBI134 | Medium | Clipboard operations via script must be disallowed (Restricted Sites zone). | A malicious script could use the clipboard in an undesirable manner, for example, if the user had recently copied confidential information to the clipboard while editing a document, a malicious... |
| DTBI091 | Medium | Java permissions must be configured with High Safety (Trusted Sites zone). | Java applications could contain malicious code. This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, options can be chosen from the drop-down... |
| DTBI092 | Medium | Antimalware programs against ActiveX controls must not be run for the Trusted Sites zone. | This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages. If you enable this policy setting,... |
| DTBI490 | Medium | Protected Mode must be enforced (Restricted Sites zone). | Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system. If you enable this policy... |
| DTBI365 | Medium | Checking for server certificate revocation must be enforced. | This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer... |
| DTBI415 | Medium | Automatic prompting for file downloads must be disallowed (Internet zone). | This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated... |
| DTBI880 | Medium | ActiveX controls without prompt property must be used in approved domains only (Restricted Sites zone). | This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control. If the user were to disable... |
| DTBI1005 | Medium | Dragging of content from different domains across windows must be disallowed (Restricted Sites zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows. If you enable this policy... |
| DTBI800 | Medium | Scripting of Internet Explorer WebBrowser control property must be disallowed (Internet zone). | This policy setting controls whether a page may control embedded WebBrowser control via script. Scripted code hosted on sites located in this zone is more likely to contain malicious code. If you... |
| DTBI395 | Medium | Scriptlets must be disallowed (Internet zone). | This policy setting allows you to manage whether scriptlets can be allowed. Scriptlets hosted on sites located in this zone are more likely to contain malicious code. If you enable this policy... |
| DTBI1000 | Medium | Dragging of content from different domains within a window must be disallowed (Internet zone). | This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window. If you enable this policy setting,... |
| DTBI390 | Medium | Script-initiated windows without size or position constraints must be disallowed (Restricted Sites zone). | This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows including the title and status bars. If you enable this policy setting, Windows Restrictions... |
| DTBI805 | Medium | ActiveX opt-in prompt must be disallowed. | This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Websites from loading any COM object without prior approval. If a page attempts to load a COM... |
| DTBI022 | Medium | The Download signed ActiveX controls property must be disallowed (Internet zone). | Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites. Signed code is better than unsigned code in that it may be easier to... |
| DTBI023 | Medium | The Download unsigned ActiveX controls property must be disallowed (Internet zone). | Unsigned code is potentially harmful, especially when coming from an untrusted zone. This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. If... |
| DTBI024 | Medium | The Initialize and script ActiveX controls not marked as safe property must be disallowed (Internet zone). | ActiveX controls that are not marked safe for scripting should not be executed. Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not... |
| DTBI780 | Medium | InPrivate Browsing must be disallowed. | InPrivate Browsing lets the user control whether or not Internet Explorer saves the browsing history, cookies, and other data. User control of settings is not the preferred control method. The... |
| DTBI697 | Low | Ability for users to enable or disable add-ons must be managed. | Users often choose to install add-ons that are not permitted by an organization's security policy. Such add-ons can pose a significant security and privacy risk to your network. This policy... |
| DTBI750 | Low | Updates to website lists from Microsoft must be disallowed. | This policy controls the website compatibility lists provided by Microsoft. If you enable this policy setting, the compatibility website lists provided by Microsoft will be used during browser... |
| DTBI367 | Low | Internet Explorer must be configured to make proxy settings per user. | This setting controls whether or not the Internet Explorer proxy settings are configured on a per-user or per-machine basis. If you enable this policy, users cannot set user specific proxy... |
