Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
Download restrictions must be configured.
Description
Discussion Text
This configures the type of downloads that Microsoft Edge completely blocks without allowing users to override the security decision.
Set "BlockDangerousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of known dangerous downloads or that have dangerous file type extensions.
Set "BlockPotentiallyDangerousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.
Set "BlockAllDownloads" to block all downloads.
Set "BlockMaliciousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.
If this policy is not configured or the "DefaultDownloadSecurity" option is not set, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.
Policy options mapping:
DefaultDownloadSecurity (0) = No special restrictions
BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types
BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types
BlockAllDownloads (3) = Block all downloads
BlockMaliciousDownloads (4) = Block malicious downloads
Set "BlockDangerousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of known dangerous downloads or that have dangerous file type extensions.
Set "BlockPotentiallyDangerousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of potentially dangerous or unwanted downloads or that have dangerous file type extensions.
Set "BlockAllDownloads" to block all downloads.
Set "BlockMaliciousDownloads" to allow all downloads except those that carry Microsoft Defender SmartScreen warnings of known malicious downloads.
If this policy is not configured or the "DefaultDownloadSecurity" option is not set, the downloads go through the usual security restrictions based on Microsoft Defender SmartScreen analysis results.
Policy options mapping:
DefaultDownloadSecurity (0) = No special restrictions
BlockDangerousDownloads (1) = Block malicious downloads and dangerous file types
BlockPotentiallyDangerousDownloads (2) = Block potentially dangerous or unwanted downloads and dangerous file types
BlockAllDownloads (3) = Block all downloads
BlockMaliciousDownloads (4) = Block malicious downloads
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.