SV-223298r961092: User name and password must be disabled in all Office programs. | Microsoft Office 365 ProPlus STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

User name and password must be disabled in all Office programs.

Description

Discussion Text

The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate website but actually opens a deceptive (spoofed) website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001170SV-108775V-99671

References

DPMS Target Microsoft Office 365 ProPlus DISA DPMS Target Microsoft Office 365 ProPlus 4099

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.office365:def:223298
# User name and password must be disabled in all Office programs.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# MS Access is installed.
# registry_object (registry_test)
function test_1 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Access\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Access.
# registry_object (registry_test)
function test_2 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('msaccess.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'msaccess.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'msaccess.exe') -eq 1))
}
# MS Excel is installed.
# registry_object (registry_test)
function test_3 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Excel\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Excel\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Excel.
# registry_object (registry_test)
function test_4 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('excel.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'excel.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'excel.exe') -eq 1))
}
# Microsoft OneDrive for Business 2016 is installed
# registry_object (registry_test)
function test_5 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Groove\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Groove\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Groove and OneDrive.
# registry_object (registry_test)
function test_6 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('groove.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'groove.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'groove.exe') -eq 1))
}
# MS Outlook is installed.
# registry_object (registry_test)
function test_7 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Outlook\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Outlook.
# registry_object (registry_test)
function test_8 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('outlook.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'outlook.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'outlook.exe') -eq 1))
}
# MS PowerPoint is installed.
# registry_object (registry_test)
function test_9 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\PowerPoint\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\PowerPoint\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for PowerPoint.
# registry_object (registry_test)
function test_10 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('powerpnt.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'powerpnt.exe') -eq 1))
}
# MS Project is installed.
# registry_object (registry_test)
function test_11 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Project\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Project\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Project.
# registry_object (registry_test)
function test_12 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('winproj.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'winproj.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'winproj.exe') -eq 1))
}
# MS Publisher is installed.
# registry_object (registry_test)
function test_13 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Publisher\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Publisher\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Publisher.
# registry_object (registry_test)
function test_14 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('mspub.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'mspub.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'mspub.exe') -eq 1))
}
# MS Visio is installed.
# registry_object (registry_test)
function test_15 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Visio\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Visio\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Visio.
# registry_object (registry_test)
function test_16 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('visio.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'visio.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'visio.exe') -eq 1))
}
# MS Word is installed.
# registry_object (registry_test)
function test_17 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Word\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Word\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for Word.
# registry_object (registry_test)
function test_18 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('winword.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'winword.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'winword.exe') -eq 1))
}
# Microsoft OneNote 2016 is installed
# registry_object (registry_test)
function test_19 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\OneNote\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\OneNote\InstallRoot' -Name 'Path')))
}
# Disable user name and password is enabled for OneNote.
# registry_object (registry_test)
function test_20 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('onenote.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'onenote.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'onenote.exe') -eq 1))
}
# Check if the SharePoint Designer 2013 (x86) key is present
# registry_object (registry_test)
function test_21 {
  return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.SharePointDesigner' -Name ''))
}
# Check if the SharePoint Designer 2013 (x64) key is present
# registry_object (registry_test)
function test_22 {
  return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.SharePointDesigner' -Name ''))
}
# Disable user name and password is enabled for SharePoint Designer.
# registry_object (registry_test)
function test_23 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('spdesign.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'spdesign.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'spdesign.exe') -eq 1))
}
# PowerPoint Viewer is installed.
# registry_object (registry_test)
function test_24 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths' -Name 'pptview.exe')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Name 'pptview.exe')))
}
# Disable user name and password is enabled for SharePoint.
# registry_object (registry_test)
function test_25 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('pptview.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'pptview.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'pptview.exe') -eq 1))
}
# Microsoft Expressions is installed.
# registry_object (registry_test)
function test_26 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths' -Name 'exprwd.exe')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Name 'exprwd.exe')))
}
# Disable user name and password is enabled for Microsoft Expressions.
# registry_object (registry_test)
function test_27 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('exprwd.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'exprwd.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'exprwd.exe') -eq 1))
}
# Microsoft Exchange is installed.
# registry_object (registry_test)
function test_28 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths' -Name 'mse7.exe')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Name 'mse7.exe')))
}
# Disable user name and password is enabled for Microsoft Exchange.
# registry_object (registry_test)
function test_29 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE').GetValueKind('mse7.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -Name 'mse7.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'mse7.exe') -eq 1))
}

if (((test_1 -or test_2) -and (test_3 -or test_4) -and (test_5 -or test_6) -and (test_7 -or test_8) -and (test_9 -or test_10) -and (test_11 -or test_12) -and (test_13 -or test_14) -and (test_15 -or test_16) -and (test_17 -or test_18) -and (test_19 -or test_20) -and (test_21 -or test_22 -or test_23) -and (test_24 -or test_25) -and (test_26 -or test_27) -and (test_28 -or test_29))) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_office_365_proplus target this check assesses.

# OVAL Definition: oval:mil.disa.stig.office365:def:223298
if (!(Test-Path 'HKLM:\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE') -or ((Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE' -ErrorAction SilentlyContinue).Value -ne 1)) {exit 1} else {exit 0}

Remediation

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security "Disable user name and password" to "Enabled" and select the check boxes for  all installed Office programs.