SV-223308r960921: Scripted Windows Security restrictions must be enabled in all Office programs. | Microsoft Office 365 ProPlus STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Scripted Windows Security restrictions must be enabled in all Office programs.

Description

Discussion Text

Malicious websites often try to confuse or trick users into giving a site permission to perform an action allowing the site to take control of the users' computers in some manner. Disabling or not configuring this setting allows unknown websites to: - Create browser windows appearing to be from the local operating system. - Draw active windows displaying outside of the viewable areas of the screen capturing keyboard input. - Overlay parent windows with their own browser windows to hide important system information, choices, or prompts.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001695SV-108795V-99691

References

DPMS Target Microsoft Office 365 ProPlus DISA DPMS Target Microsoft Office 365 ProPlus 4099

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.office365:def:223308
# Scripted Windows Security restrictions must be enabled in all Office programs.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# MS Access is installed.
# registry_object (registry_test)
function test_1 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Access\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Access\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Access.
# registry_object (registry_test)
function test_2 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('msaccess.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'msaccess.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'msaccess.exe') -eq 1))
}
# MS Excel is installed.
# registry_object (registry_test)
function test_3 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Excel\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Excel\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Excel.
# registry_object (registry_test)
function test_4 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('excel.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'excel.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'excel.exe') -eq 1))
}
# Microsoft OneDrive for Business 2016 is installed
# registry_object (registry_test)
function test_5 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Groove\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Groove\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Groove and OneDrive.
# registry_object (registry_test)
function test_6 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('groove.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'groove.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'groove.exe') -eq 1))
}
# MS Outlook is installed.
# registry_object (registry_test)
function test_7 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Outlook\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Outlook\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Outlook.
# registry_object (registry_test)
function test_8 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('outlook.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'outlook.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'outlook.exe') -eq 1))
}
# MS PowerPoint is installed.
# registry_object (registry_test)
function test_9 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\PowerPoint\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\PowerPoint\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for PowerPoint.
# registry_object (registry_test)
function test_10 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('powerpnt.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'powerpnt.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'powerpnt.exe') -eq 1))
}
# MS Project is installed.
# registry_object (registry_test)
function test_11 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Project\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Project\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Project.
# registry_object (registry_test)
function test_12 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('winproj.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'winproj.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'winproj.exe') -eq 1))
}
# MS Publisher is installed.
# registry_object (registry_test)
function test_13 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Publisher\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Publisher\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Publisher.
# registry_object (registry_test)
function test_14 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('mspub.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'mspub.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'mspub.exe') -eq 1))
}
# MS Visio is installed.
# registry_object (registry_test)
function test_15 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Visio\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Visio\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Visio.
# registry_object (registry_test)
function test_16 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('visio.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'visio.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'visio.exe') -eq 1))
}
# MS Word is installed.
# registry_object (registry_test)
function test_17 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\Word\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Word\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for Word.
# registry_object (registry_test)
function test_18 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('winword.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'winword.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'winword.exe') -eq 1))
}
# Microsoft OneNote 2016 is installed
# registry_object (registry_test)
function test_19 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\16.0\OneNote\InstallRoot' -Name 'Path')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\OneNote\InstallRoot' -Name 'Path')))
}
# Scripted Window Security Restrictions is enabled for OneNote.
# registry_object (registry_test)
function test_20 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('onenote.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'onenote.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'onenote.exe') -eq 1))
}
# Check if the SharePoint Designer 2013 (x86) key is present
# registry_object (registry_test)
function test_21 {
  return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Office15.SharePointDesigner' -Name ''))
}
# Check if the SharePoint Designer 2013 (x64) key is present
# registry_object (registry_test)
function test_22 {
  return ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.SharePointDesigner' -Name ''))
}
# Scripted Window Security Restrictions is enabled for SharePoint Designer.
# registry_object (registry_test)
function test_23 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('spdesign.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'spdesign.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'spdesign.exe') -eq 1))
}
# PowerPoint Viewer is installed.
# registry_object (registry_test)
function test_24 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths' -Name 'pptview.exe')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Name 'pptview.exe')))
}
# Scripted Window Security Restrictions is enabled for SharePoint.
# registry_object (registry_test)
function test_25 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('pptview.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'pptview.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'pptview.exe') -eq 1))
}
# Microsoft Expressions is installed.
# registry_object (registry_test)
function test_26 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths' -Name 'exprwd.exe')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Name 'exprwd.exe')))
}
# Scripted Window Security Restrictions is enabled for Microsoft Expressions.
# registry_object (registry_test)
function test_27 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('exprwd.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'exprwd.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'exprwd.exe') -eq 1))
}
# Microsoft Exchange is installed.
# registry_object (registry_test)
function test_28 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths' -Name 'mse7.exe')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths' -Name 'mse7.exe')))
}
# Scripted Window Security Restrictions is enabled for Microsoft Exchange.
# registry_object (registry_test)
function test_29 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS').GetValueKind('mse7.exe').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS' -Name 'mse7.exe' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'mse7.exe') -eq 1))
}

if (((test_1 -or test_2) -and (test_3 -or test_4) -and (test_5 -or test_6) -and (test_7 -or test_8) -and (test_9 -or test_10) -and (test_11 -or test_12) -and (test_13 -or test_14) -and (test_15 -or test_16) -and (test_17 -or test_18) -and (test_19 -or test_20) -and (test_21 -or test_22 -or test_23) -and (test_24 -or test_25) -and (test_26 -or test_27) -and (test_28 -or test_29))) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_office_365_proplus target this check assesses.

# oval:mil.disa.stig.office365:def:223308
$compliant = $true
$officeVersion = 16
$installedApps = @("EXCEL.EXE", "OUTLOOK.EXE", "POWERPNT.EXE", "WINWORD.EXE", "MSACCESS.EXE")
foreach ($app in $installedApps) {
    if (Test-Path "HKLM:\SOFTWARE\Microsoft\Office\$officeVersion.0\$app\InstallRoot") {
        $featureControlPath = "HKLM:\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS"
        if (-not (Test-Path $featureControlPath)) { $compliant = $false; continue }
        $featureControl = (Get-ItemProperty -Path $featureControlPath -ErrorAction SilentlyContinue).FEATURE_WINDOW_RESTRICTIONS
        if ($featureControl -and $featureControl.PSObject.Properties.Value -notcontains "*$app.EXE") { $compliant = $false }
    }
}
if ($compliant) { Write-Output "PASS"; Exit 0 } else { Write-Output "FAIL"; Exit 1 }

Remediation

Set the policy value for Computer Configuration >> Administrative Templates >> Microsoft Office 2016 (Machine) >> Security Settings >> IE Security >>Scripted Window Security Restrictions to "Enabled" and select the check boxes for  all installed Office programs.