8.3.13 Set 'Download unsigned ActiveX controls' to 'Enabled:Disable'

Information

*Description*

This policy setting allows you to manage whether users may download unsigned ActiveX
controls from the zone. The recommended state for this setting is- Enabled-Disable.

*Rationale*

Unsigned code is potentially harmful, especially when coming from an untrusted zone.

Solution

To implement the recommended configuration state, set the following Group Policy setting
to Enabled.

Computer Configuration\Administrative Templates\Windows Components\Internet
Explorer\Internet Control Panel\Security Page\Restricted Sites Zone\Download unsigned
ActiveX controls\Download unsigned ActiveX controls

Then set the Download unsigned ActiveX controls option to Disable.

Impact-If you enable this policy setting, users can run unsigned controls without user intervention.
If you select Prompt in the drop-down box, users are queried to choose whether to allow
the unsigned control to run. If you disable this policy setting, users cannot run unsigned
controls. If you do not configure this policy setting, users cannot run unsigned controls.

See Also

https://workbench.cisecurity.org/files/1516

Item Details

Audit Name: CIS IE 9 v1.0.0

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-18(3)

Plugin: Windows

Control ID: d922e503aa97e4c9e6b9e02dac39128074256d596a0a331a7cc859d366c0bb12