The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.
# Windows PowerShell
# Reconstructed from oval:mil.disa.stig.windows11:def:256893
# Internet Explorer must be disabled for Windows 11.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
# Internet Explorer 11 optional feature disabled or not installed
# wmi57_object (wmi57_test)
function test_1 {
return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT installstate FROM win32_optionalfeature WHERE name = ''Internet-Explorer-Optional-amd64''' | Select-Object -First 1) | Select-Object -ExpandProperty 'installstate') -eq '2')
}
# The OS is Windows Enterprise LTSB/LTSC
# registry_object (registry_test)
function test_2 {
return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion').GetValueKind('EditionId').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion' -Name 'EditionId' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'EditionId') -eq 'EnterpriseS'))
}
# Internet Explorer 11 is disabled as a standalone browser
# registry_object (registry_test)
function test_3 {
return ((((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main').GetValueKind('NotifyDisableIEOptions').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main' -Name 'NotifyDisableIEOptions' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'NotifyDisableIEOptions') -eq 0)) -or (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main').GetValueKind('NotifyDisableIEOptions').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main' -Name 'NotifyDisableIEOptions' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'NotifyDisableIEOptions') -eq 1)) -or (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main').GetValueKind('NotifyDisableIEOptions').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main' -Name 'NotifyDisableIEOptions' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'NotifyDisableIEOptions') -eq 2)))
}
# 64-bit Microsoft Edge is installed
# registry_object (registry_test)
function test_4 {
return (-not ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -Name 'DisplayName')))
}
# 32-bit Microsoft Edge is installed
# registry_object (registry_test)
function test_5 {
return (-not ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall' -Name 'DisplayName')))
}
if ((test_1 -or test_2 -or (test_3 -and (test_4 -or test_5)))) {
Write-Output "PASS"
} else {
Write-Output "FAIL"
} Assessment Script Powered by AISyntax-verified
A standalone PowerShell script to assess this control automatically. Review before running it in your environment.
Syntax-checked as valid PowerShell. Not executed here — running it for real needs the actual ms_windows_11 target this check assesses.
# This script implements oval:mil.disa.stig.windows11:def:256893
$ie11OptionalFeature = Get-CimInstance -ClassName Win32_OptionalFeature -Filter "Name='Internet-Explorer-Optional-amd64'"
if ($ie11OptionalFeature -eq $null -or $ie11OptionalFeature.InstallState -ne 2) {exit 1}
$iePolicy = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Internet Explorer\Main' -Name NotifyDisableIEOptions -ErrorAction SilentlyContinue
if ($iePolicy -eq $null -or $iePolicy.NotifyDisableIEOptions -notin 0,1,2) {exit 1}
exit 0