UCF STIG Viewer Logo

Dynamic Data Exchange (DDE) server lookup in Excel must be blocked.


Overview

Finding ID Version Rule ID IA Controls Severity
V-223313 O365-EX-000004 SV-223313r508019_rule Medium
Description
This policy setting allows you to control whether Dynamic Data Exchange (DDE) server lookup is allowed. By default, DDE server lookup is turned on, but users can turn off DDE server lookup by going to File >> Options >> Trust Center >> Trust Center Settings >> External Content. If you enable this policy setting, DDE server lookup is not allowed, and users cannot turn on DDE server lookup in the Trust Center. Note: If you are using Dynamic Data Exchange (DDE) server launch, which is not recommended, do not enable this policy setting, because DDE server launch requires DDE server lookup to be on. If you disable or do not configure this policy setting, DDE server lookup is turned on, but users can turn off DDE server lookup in the Trust Center. Note: This policy setting only applies to subscription versions of Office, such as Office 365 ProPlus.
STIG Date
Microsoft Office 365 ProPlus Security Technical Implementation Guide 2021-03-22

Details

Check Text ( C-24986r442158_chk )
Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server lookup in Excel is set to "Enabled".

Use the Windows Registry Editor to navigate to the following key:

HKCU\software\policies\microsoft\office\16.0\excel\security\external content

If the value for "disableddeserverlookup" is REG_DWORD = 1, this is not a finding.
Fix Text (F-24974r442159_fix)
Set policy value for User Configuration >> Administrative Templates >> Microsoft Excel 2016 >> Excel Options >> Security >> Trust Center >> External Content >> Don't allow Dynamic Data Exchange (DDE) server lookup in Excel to "Enabled".