18.8.22.1.5 (L2) Ensure 'Turn off Internet File Association service' is set to 'Enabled'

Information

This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application.

The recommended state for this setting is: Enabled

This service's purpose is to help find an appropriate application for a file whose type is unrecognized by the computer. That could pose a security risk if the unrecognized file is malicious code, even if the application to be discovered is itself innocent. Enterprise environments tend to be very managed, where the IT staff decides which applications should and should not be installed.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled:

Computer Configuration\Policies\Administrative Templates\System\Internet Communication Management\Internet Communication settings\Turn off Internet File Association service

Note: This Group Policy path is provided by the Group Policy template ICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.

Impact:

The link and the dialog for using the Web service to open an unhandled file association are removed.

See Also

https://workbench.cisecurity.org/benchmarks/14289