Microsoft Internet Explorer 11 Security Technical Implementation Guide

The Microsoft Internet Explorer 11 Security Technical Implementation Guide (V2 R7) has 137 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

137STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R7

CurrentPublished Wed Apr 01 2026

Prevent per-user installation of ActiveX controls must be enabled.

Microsoft Internet Explorer 11 Security Technical Implementation Guide

Assessment Title

Rule Text

Prevent per-user installation of ActiveX controls must be enabled.

Description

Discussion Text

This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis. If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis. If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-223041

Rule

SV-223041r961092_rule

Severity

medium

Rule Version

DTBI1070-IE11

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

The policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent per-user installation of ActiveX controls" must be "Enabled". 

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security\ActiveX. 

Criteria: If the value "BlockNonAdminActiveXInstall" is REG_DWORD = 1, this is not a finding.

Implementation Procedure

Fix Text

Set the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Internet Explorer >> "Prevent per-user installation of ActiveX controls" to "Enabled".

STIG check 27 of 137 in the Microsoft Internet Explorer 11 STIG checklist

← Previous · V-223040Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the internet must be enabled.Next · V-223042 →Prevent ignoring certificate errors option must be enabled.