SV-223352r961092: Active X One-Off forms must only be enabled to load with Outlook Controls. | Microsoft Office 365 ProPlus STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Active X One-Off forms must only be enabled to load with Outlook Controls.

Description

Discussion Text

By default, third-party ActiveX controls are not allowed to run in one-off forms in Outlook. You can change this behavior so that Safe Controls (Microsoft Forms 2.0 controls and the Outlook Recipient and Body controls) are allowed in one-off forms, or so that all ActiveX controls are allowed to run.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-001170SV-108883V-99779

References

DPMS Target Microsoft Office 365 ProPlus DISA DPMS Target Microsoft Office 365 ProPlus 4099

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISyntax-verified

A standalone PowerShell script to assess this control automatically. Review before running it in your environment.

Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_office_365_proplus target this check assesses.

# OVAL Definition: oval:mil.disa.stig.office365:def:223352
if (Test-Path -Path 'HKCU:\Software\Policies\Microsoft\Office\16.0\outlook\security\allowactivexoneoffforms' -and (Get-ItemProperty -Path 'HKCU:\Software\Policies\Microsoft\Office\16.0\outlook\security\allowactivexoneoffforms' -ErrorAction SilentlyContinue).Value -eq 0) {Write-Output "PASS"; Exit 0} else {Write-Output "FAIL"; Exit 1}

Remediation

Set the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Allow Active X One Off Forms to "Enabled" "Load only Outlook Controls".