ActiveX opt-in prompt must be disallowed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-46851	DTBI805-IE11	SV-59717r1_rule	ECSC-1	Medium

Description
This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents websites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an information bar will appear asking the user for approval. If you enable this policy setting, the ActiveX opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks. If you disable or do not configure this policy setting the ActiveX opt-in prompt will appear.

Description

This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents websites from loading any COM object without prior approval. If a page attempts to load a COM object that Internet Explorer has not used before, an information bar will appear asking the user for approval. If you enable this policy setting, the ActiveX opt-in prompt will not appear. Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks. If you disable or do not configure this policy setting the ActiveX opt-in prompt will appear.

STIG	Date
Microsoft Internet Explorer 11 Security Technical Implementation Guide	2014-05-13

Details

Check Text ( C-49927r2_chk )
The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off ActiveX opt-in prompt' must be 'Enabled'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext Criteria: If the value "NoFirsttimeprompt" is REG_DWORD = 1, this is not a finding.

Fix Text (F-50587r1_fix)
Set the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> 'Turn off ActiveX opt-in prompt' to 'Enabled'.