accepted This guide has been created to assist IT professionals in effectively securing systems with Microsoft Internet Explorer 7 installed. Do not attempt to implement any of the settings in this guide without first testing them in a non-operational environment. NIST assumes no responsibility whatsoever for its use by other parties, and makes no guarantees, expressed or implied, about its quality, reliability, or any other characteristic. NIST would appreciate acknowledgement if the document and template are used. todo - add text Trademark InformationMicrosoft, Windows, Windows XP, Windows Vista, Internet Explorer, and Windows Firewall are either registered trademarks or trademarks of Microsoft Corporation in the United States and other countries.All other names are registered trademarks or trademarks of their respective companies. National Institute of Standards and Technology SP 800-68 v1.2.0.0 This profile selects specific controls that are recommended by Special Publication 800-53 for information systems in which all three security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of low. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile selects specific controls that are recommended by Special Publication 800-53 for information systems in which at least one security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of moderate and no security objective is assigned a FIPS 199 potential impact value of high. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile selects specific controls that are recommended by Special Publication 800-53 for information systems in which at least one security objectives (i.e., confidentiality, integrity, and availability) are assigned a FIPS 199 potential impact value of high. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile selects all the security controls that are recommended by Special Publication 800-53 for information systems. Each control has an effect on other groups within this document as individual rule require certain controls to be selected. This profile represents guidance outlined by the Federal Core Configuration for a desktop system with Microsoft Internet Explorer 7 installed. This guide has been created to assist federal agencies in effectively securing systems with Microsoft Windows Internet Explorer 7 based on OMB Federal Desktop Core Configuration recommendations.Under the direction of OMB and in collaboration with DHS, DISA, NSA, USAF, and Microsoft, NIST has provided the following baseline to help agencies test, implement, and deploy the Microsoft Windows Internet Explorer 7 Federal Desktop Core Configuration (FDCC) baseline. The Federal Desktop Core Configuration (FDCC) is an OMB-mandated security configuration.Please refer to the FDCC home page for additional information. http://fdcc.nist.gov FDCC has identified the following additional controls that must be checked in order to verify compliance. todo - description needed The following are some additional settings for Microsoft Internet Explorer 7 DisableConfiguringHistory_LocalComputer_1_var 1 1 DisableConfiguringHistory_LocalComputer_2_var 40 40 DisableAutomaticInstallOfIEComponents_LocalComputer_var 1 1 DisableChangingAutomaticConfigurationSettings_LocalComputer_var 1 1 DisablePeriodicCheckForIESoftwareUpdates_LocalComputer_var 1 1 DisableShowingSplashScreen_LocalComputer_var 1 1 DisableSoftwareUpdateShellNotifications_LocalComputer_var 1 1 DoNotAllowUsersEnableDisableAddOns_LocalComputer_var 0 0 MakeProxySettingsPerMachine_LocalComputer_var 1 1 0 PreventParticipationInCustomerExperienceImprovementPrograms_LocalComputer_var 0 1 0 PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var 1 1 2 DoNotAllowUsersAddDeleteSites_LocalComputer_var 1 1 DoNotAllowUsersChangePolicies_LocalComputer_var 1 1 use_only_machine_settings_local_computer_var 1 1 TurnOffDeleteBrowsingHistoryFunctionality_LocalComputer_var 1 0 1 TurnOffCrashDetection_LocalComputer_var 1 1 TurnOffManagingPhishingFilter_LocalComputer_var 0 0 1 2 TurnOffSecuritySettingsCheckFeature_LocalComputer_var 0 0 1 This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options and General tab. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4001-4 CCE-66 This Disable Automatic Install of Internet Explorer components setting prevents Internet Explorer from automatically installing components. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3518-8 CCE-684 This Disable Automatic Install of Internet Explorer components setting prevents Internet Explorer from automatically installing components. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4147-5 CCE-471 The Disable Periodic Check for Internet Explorer software updates setting prevents Internet Explorer from more frequently checking whether a new browser update is available. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3576-6 CCE-212 The Disable showing the splash screen setting prevents the Internet Explorer splash screen from appearing when users start the browser. Enabling this policy causes the splash screen, which normally displays the program name, licensing, and copyright information GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3706-9 CCE-556 The Disable software update shell notifications on program launch setting specifies that programs using the Microsoft Software Distribution Channel will not notify users when they install new components. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4118-6 CCE-622 The Do not allow users to enable or disable add-ons policy setting allows you to manage whether users have the ability to allow or deny add-ons through Manage Add-ons. If you configure this policy setting to Enabled, users cannot enable or disable add-ons. This item is disabled. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3744-0 CCE-708 The Make proxy settings per – machine (rather than per-user) setting ensures proxy settings for all users of the same computer are the same. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3201-1 CCE-693 This policy setting prevents users from participating in the Customer Experience Improvement Program (CEIP). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3993-3 CCE-495 This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3207-8 CCE-1006 The Security Zones: Do not allow users to add/delete sites setting prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3929-7 CCE-146 The Security Zones: Do not allow users to change policies setting prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3933-9 CCE-833 Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level. If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4017-0 CCE-5 This policy setting prevents users from performing the "Delete Browsing History" action in Internet Explorer. If you enable this policy setting, users cannot perform the "Delete Browsing History" action in Internet Options for Internet Explorer 7. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3615-2 CCE-1010 The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3894-3 CCE-753 This policy setting allows the user to enable a phishing filter that will warn if the Web site being visited is known for fraudulent attempts to gather personal information through "phishing." GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3866-1 CCE-1032 This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3875-2 CCE-1054 todo - description needed prevent_ignoring_certificate_errors_local_computer_var 1 0 1 Internet Explorer treats as fatal any Secure Socket Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt navigation (such as "expired," "revoked," or "name mismatch" errors). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel CCE-4199-6 CCE-938 Advanced Page - Local Computer Allow Active Content from CD's to Run on User Machine - Local Computer - variable 0 0 1 todo - description needed 0 0 1 Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable 0 0 1 Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable no no yes Allow Third-Party Browser Extensions - Local Computer - variable 1 1 0 Check for Server Certificate Revocation - Local Computer - variable 1 0 1 Check for Signature on Downloaded Programs - Local Computer - variable yes no yes Do Not Allow Resetting Internet Explorer Settings - Local Computer - variable 1 0 1 This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run. If you enable this policy setting, active content on a CD will run without a prompt. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-4174-9 CCE-964 The "Allow Install On Demand (Internet Explorer)" setting should be configured correctly. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-3677-2 CCE-69 Microsoft ActiveX controls and file downloads often have digital signatures attached that vouch for both the file's integrity and the identity of the signer (creator) of the software. Such signatures help ensure that unmodified. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-3941-2 CCE-449 This policy setting allows you to manage whether Internet Explorer will launch COM add-ons known as browser helper objects, such as toolbars. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-4192-1 CCE-598 This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-3584-0 CCE-1008 This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-3976-8 CCE-690 This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-4026-1 CCE-1025 This policy setting prevents users from using the Reset Internet Explorer Settings feature. Reset Internet Explorer Settings will allow the users to reset all settings changed since install, delete browsing history and disable add-ons that are not preapproved. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page CCE-4171-5 CCE-42 Security Page - Local Computer include_all_network_paths_local_computer_var 0 0 1 This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone. If you enable this policy setting, all network paths are mapped into the Intranet Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page CCE-4175-6 CCE-876 Computer-wide, rather than per-user, assignment of sites to zones for Internet Explorer should be enabled or disabled as appropriate. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page CCE-4763-9 CCE-1005 Internet Zone - Local Computer access_data_sources_across_domains_internet_zone_local_computer_var 3 0 1 3 allow_cut_copy_paste_operations_from_clipboard_via_script_internet_zone_local_computer_var 3 0 1 3 AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var 3 0 1 3 AllowFontDownloads_InternetZone_LocalComputer_var 3 0 1 3 AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var 3 0 1 3 AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var 3 0 3 allow_scriptlets_internet_zone_local_computer_var 3 0 3 allow_status_bar_updates_via_script_internet_zone_local_computer_var 0 0 0 1 3 AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var 0 0 3 download_signed_activex_controls_InternetZone_LocalComputer_var 3 0 1 3 DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var 3 0 1 3 InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var 3 0 1 3 java_permissions_internet_zone_local_computer_var 0 0 65536 131072 196608 8388608 LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var 3 0 1 3 LogonOptions_InternetZone_LocalComputer_var 65536 0 65536 131072 196608 LooseXAMLFiles_InternetZone_LocalComputer_var 3 0 1 3 navigate_sub_frames_across_different_domains_Internet_zone_local_computer_var 0 0 0 1 3 OpenFilesBasedOnContent_InternetZone_LocalComputer_var 3 0 3 SoftwareChannelPermissions_InternetZone_LocalComputer_var 65536 65536 131072 196608 todo - description needed 0 0 3 todo - description needed 0 0 3 UsePop-upBlocker_InternetZone_LocalComputer_var 0 0 1 3 UserdataPersistence_InternetZone_LocalComputer_var 3 0 3 WebBrowserApplications_InternetZone_LocalComputer_var 0 0 0 1 3 WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var 3 0 1 3 This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3853-9 CCE-47 This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4109-5 CCE-49 This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3998-2 CCE-685 This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3888-5 CCE-491 This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3906-5 CCE-355 This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4099-8 CCE-280 This policy setting allows you to manage whether scriptlets can be allowed. If you enable this policy setting, users will be able to run scriptlets. If you disable this policy setting, users will not be able to run scriptlets. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3601-2 CCE-439 This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3249-0 CCE-914 This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4139-2 CCE-16 This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3927-1 CCE-1013 This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3945-3 CCE-176 This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4068-3 CCE-586 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3963-6 CCE-132 This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4104-6 CCE-689 This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3623-6 CCE-720 These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3751-5 CCE-126 This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4143-4 CCE-245 This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4161-6 CCE-910 This policy setting allows you to manage software channel permissions. If you enable this policy setting, you can choose the following options from the drop-down box. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3553-5 CCE-359 Turn Off First-Run Opt-In GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3378-7 CCE-863 The "Turn on Protected Mode" setting should be configured correctly for the Internet Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4643-3 CCE-281 This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. If you enable this policy setting, most unwanted pop-up windows are prevented from appearing. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3619-4 CCE-1002 This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3914-9 CCE-425 These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-4131-9 CCE-286 This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone CCE-3570-9 CCE-724 Intranet Zone - Local Computer display_mixed_content_intranet_zone_local_computer_var 0 0 1 3 java_permissions_intranet_zone_local_computer_var 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone CCE-3989-1 CCE-288 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone CCE-4652-4 CCE-218 Local Machine Zone - Local Computer display_mixed_content-local_machine_zone_local_computer_var 0 0 1 3 java_permissions_local_machine_zone_local_computer_var 0 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone CCE-4138-4 CCE-473 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone CCE-3891-9 CCE-138 Locked Down Internet Zone - Local Computer todo - description needed 0 0 1 3 todo - description needed 0 0 1 3 todo - description needed 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone CCE-3984-2 CCE-878 The "Download signed ActiveX controls" setting should be configured correctly for the Locked-Down Internet Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone CCE-4793-6 CCE-308 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone CCE-4692-0 CCE-781 LockedDown Intranet Zone - Local Computer display_mixed_content-LockedDownintranet_zone_local_computer_var 0 0 1 3 java_permissions_LockedDownintranet_zone_local_computer_var 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone CCE-4121-0 CCE-552 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone CCE-3754-9 CCE-320 Locked Down Local Machine Zone - Local Computer display_mixed_content-LockedDownlocal_machine_zone_local_computer_var 0 0 1 3 java_permissions_LockedDownlocal_machine_zone_local_computer_var 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone CCE-4028-7 CCE-239 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone CCE-4160-8 CCE-1045 Locked Down Restricted Sites Zone - Local Computer display_mixed_content-LockedDownRestrictedSitesZone_LocalComputer_var 0 0 1 3 java_permissions_LockedDownRestrictedSitesZone_LocalComputer_var 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone CCE-3264-9 CCE-30 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone CCE-3902-4 CCE-1088 Locked Down Trusted Sites Zone - Local Computer todo - description needed 3 0 1 3 display_mixed_content_LockedDowntrusted_sites_zone_local_computer_var 0 0 1 3 java_permissions_LockedDowntrusted_sites_zone_local_computer_var 0 0 65536 131072 196608 8388608 The "Allow status bar updates via script" setting should be configured correctly for the Locked-Down Trusted Sites Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone CCE-4546-8 CCE-1147 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone CCE-4232-5 CCE-666 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone CCE-4564-1 CCE-140 Restricted Sites Zone - Local Computer AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowActiveScripting_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowFileDownloads_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowFontDownloads_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var 3 0 1 3 AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var 3 0 3 AllowStatusBarUpdatesViaScript_RestrictedSitesZone_LocalComputer_var 0 0 0 1 3 AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var 0 0 3 download_signed_activex_controls_RestrictedSitesZone_LocalComputer_var 3 0 1 3 DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var 3 0 1 3 InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var 3 0 1 3 java_permissions_RestrictedSitesZone_LocalComputer_var 0 0 65536 131072 196608 8388608 LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var 3 0 1 3 LogonOptions_RestrictedSitesZone_LocalComputer_var 196608 0 65536 131072 196608 LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var 3 0 1 3 NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var 3 0 1 3 OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var 3 0 3 RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var 3 0 1 3 RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var 3 0 1 3 RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var 3 0 1 3 ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var 3 0 1 3 ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var 3 0 1 3 SoftwareChannelPermissions_RestrictedSitesZone_LocalComputer_var 65536 65536 131072 196608 TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var 0 0 3 todo - description needed 0 0 3 UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var 0 0 1 3 UserdataPersistence_RestrictedSitesZone_LocalComputer_var 3 0 3 WebBrowserApplications_RestrictedSitesZone_LocalComputer_var 0 0 0 1 3 WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var 3 0 1 3 This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3905-7 CCE-636 This policy setting allows you to manage whether script code on pages in the zone is run. If you enable this policy setting, script code on pages in the zone can run automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4050-1 CCE-292 This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. If you enable this policy setting, binary and script behaviors are available. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4196-2 CCE-178 This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region. If you enable this policy setting, a script can perform a clipboard operation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4013-9 CCE-1031 This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone. If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3337-3 CCE-41 This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4150-9 CCE-970 This policy setting allows you to manage whether pages of the zone may download HTML fonts. If you enable this policy setting, HTML fonts can be downloaded automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4062-6 CCE-882 This policy setting allows you to manage whether users can install Active Desktop items from this zone. The settings for this option are: If you enable this policy setting, users can install desktop items from this zone automatically. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4079-0 CCE-763 This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4084-0 CCE-680 This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars. If you enable this policy setting, Windows Restrictions security will not apply in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4119-4 CCE-208 This policy setting allows you to manage whether script is allowed to update the status bar within the zone. If you enable this policy setting, script is allowed to update the status bar. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4031-1 CCE-129 This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4053-5 CCE-175 This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone. If you enable this policy, users can download signed controls without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4057-6 CCE-52 This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3564-2 CCE-1012 This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4101-2 CCE-26 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3996-6 CCE-925 This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4066-7 CCE-339 This policy setting allows you to manage settings for logon options. If you enable this policy setting, you can choose from the following logon options. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3696-2 CCE-128 These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3590-7 CCE-639 This policy setting allows you to manage the opening of sub-frames and access of applications across different domains. If you enable this policy setting, users can open sub-frames from other domains and access applications from other domains. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4110-3 CCE-995 This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4132-7 CCE-409 This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3400-9 CCE-678 This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4158-2 CCE-563 This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone. If you enable this policy setting, controls and plug-ins can run without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4163-2 CCE-841 This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script. If you enable this policy setting, script interaction can occur automatically without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4202-8 CCE-973 This policy setting allows you to manage whether applets are exposed to scripts within the zone. If you enable this policy setting, scripts can access applets automatically without user intervention. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3216-9 CCE-1000 This policy setting allows you to manage software channel permissions. If you enable this policy setting, you can choose the following options from the drop-down box. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3855-4 CCE-520 Turn Off First-Run Opt-In GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4153-3 CCE-200 The "Turn on Protected Mode" setting should be configured correctly for the Restricted Sites Zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-3909-9 CCE-1211 This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4018-8 CCE-660 This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4040-2 CCE-28 These are browser-hosted, ClickOnce-deployed applications built using WinFX. These applications execute in a security sandbox and harness the power of the Windows Presentation Foundation platform for the Web. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4052-7 CCE-51 This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone CCE-4215-0 CCE-698 Trusted Sites Zone - Local Computer display_mixed_content_trusted_sites_zone_local_computer_var 0 0 1 3 java_permissions_trusted_sites_zone_local_computer_var 0 0 65536 131072 196608 8388608 This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone CCE-4087-3 CCE-31 This policy setting allows you to manage permissions for Java applets. If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone CCE-4845-4 CCE-675 Periodic Check for Updates to Internet Explorer and Internet Tools - Local Computer TurnOffChangingURLDisplay_LocalComputer_var TurnOffConfiguringUpdateCheckInterval_LocalComputer_var 30 30 This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodic check for updates to Internet Explorer and Internet Tools CCE-3204-5 CCE-946 This setting specifies the update check interval. The default value is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Component Updates\Periodic check for updates to Internet Explorer and Internet Tools CCE-4098-0 CCE-237 todo - description needed EnableNativeXMLHttpSupport_LocalComputer_var 0 0 1 Enable Native XMLHttp Support - Local Computer GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features CCE-4259-8 CCE-528 Consistent Mime Handling - Local Computer IEProcesses_ConsistentMimeHandling_LocalComputer_1_var 1 0 1 IEProcesses_ConsistentMimeHandling_LocalComputer_2_var 1 0 1 IEProcesses_ConsistentMimeHandling_LocalComputer_3_var 1 0 1 Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling CCE-4047-7 CCE-382 Mime Sniffing Safety Feature - Local Computer IEProcesses_MimeSniffingSafetyFeature_LocalComputer_1_var 1 0 1 IEProcesses_MimeSniffingSafetyFeature_LocalComputer_2_var 1 0 1 IEProcesses_MimeSniffingSafetyFeature_LocalComputer_3_var 1 0 1 MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature CCE-4149-1 CCE-985 MK Protocol Security Restriction - Local Computer IEProcesses_MKProtocolSecurityRestriction_LocalComputer_1_var 1 0 1 IEProcesses_MKProtocolSecurityRestriction_LocalComputer_2_var 1 0 1 IEProcesses_MKProtocolSecurityRestriction_LocalComputer_3_var 1 0 1 The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction CCE-3338-1 CCE-591 Protection From Zone Elevation - Local Computer IEProcesses_ProtectionFromZoneElevation_LocalComputer_1_var 1 0 1 IEProcesses_ProtectionFromZoneElevation_LocalComputer_2_var 1 0 1 IEProcesses_ProtectionFromZoneElevation_LocalComputer_3_var 1 0 1 Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet zone, Intranet zone, or Local Machine zone). GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation CCE-4043-6 CCE-347 Restrict ActiveX Install - Local Computer IEProcesses_RestrictActiveXInstall_LocalComputer_1_var 1 0 1 IEProcesses_RestrictActiveXInstall_LocalComputer_2_var 1 0 1 IEProcesses_RestrictActiveXInstall_LocalComputer_3_var 1 0 1 The Restrict ActiveX Install\Internet Explorer Processes policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install CCE-3924-8 CCE-119 Restrict File Download - Local Computer IEProcesses_RestrictFileDownload_LocalComputer_1_var 1 0 1 IEProcesses_RestrictFileDownload_LocalComputer_2_var 1 0 1 IEProcesses_RestrictFileDownload_LocalComputer_3_var 1 0 1 In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Restrict File Download CCE-4122-8 CCE-668 Scripted Window Security Restrictions - Local Computer IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_1_var 1 0 1 IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_2_var 1 0 1 IEProcesses_ScriptedWindowSecurityRestrictions_LocalComputer_3_var 1 0 1 Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code. GPO Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions CCE-4162-4 CCE-827 RSS Feeds Turn off downloading of enclosures 1 0 1 Turn off downloading of enclosures GPO Computer Configuration\Administrative Templates\Windows Components\RSS Feeds CCE-4581-5 CCE-3477-7 CCE-767 todo - description needed configure_outlook_express_local_user_var 0 0 1 DisableAutoCompleteForForms_LocalUser_1_var no no yes DisableAutoCompleteForForms_LocalUser_2_var 1 1 DisableExternalBrandingOfIE_LocalUser_var 1 1 DisableInternetConnectionWizard_LocalUser_var 1 1 DisableResetWebSettingsFeature_LocalUser_var 1 1 TurnOnAutoCompleteFeatureForUserNamesAndPasswords_LocalUser_1_var no no yes TurnOnAutoCompleteFeatureForUserNamesAndPasswords_LocalUser_2_var 1 1 TurnOffPageTransitions_LocalUser_var 0 0 1 TurnOnInternetConnectionWizardAutoDetect_LocalUser_var 1 0 1 The Configure Outlook Express setting allows administrators to enable and disable the ability for Microsoft Outlook Express users to save or open attachments that can potentially contain a virus. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3275-5 CCE-963 This AutoComplete feature suggests possible matches when users are filling up forms. If you enable this setting, the user is not suggested matches when filling forms. The user cannot change it. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4246-5 CCE-478 Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by another party. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4237-4 CCE-1051 Prevents users from running the Internet Connection Wizard. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3825-7 CCE-769 Prevents users from restoring default settings for home and search pages. If you enable this policy, the Reset Web Settings button on the Programs tab in the Internet Options dialog box appears dimmed. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-4226-7 CCE-625 This AutoComplete feature can remember and suggest User names and passwords on Forms. If you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer CCE-3647-5 CCE-721 This policy setting specifies if, as you move from one Web page to another, Internet Explorer fades out of the page you are leaving and fades into the page to which you are going. If you enable this policy setting, page transitions will be turned off. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced Settings\Browsing CCE-4056-8 CCE-71 This policy setting determines if the Internet Connection Wizard was completed. If it was not completed, it launches the Internet Connection Wizard. GPO User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Settings\Advanced Settings\Internet Connection Wizard Settings CCE-4036-0 CCE-258 Securing a given computer has become increasingly important. As such, it is essential to keep a host up to current patch levels to eliminate known vulnerabilities and weaknesses. In conjunction with antivirus software and a personal firewall, patching goes a long way to securing a host against outside attacks and exploitation. Microsoft provides two mechanisms for distributing security updates: Automatic Updates and Microsoft Update. In smaller environments, either method may be sufficient for keeping systems current with patches. Other environments typically have a software change management control process or a patch management program that tests patches before deploying them; distribution may then occur through local Windows Update Services (WUS) or Windows Server Update Services (WSUS) servers, which provide approved security patches for use by the Automatic Updates feature. Keep systems up to current patch levels to eliminate known vulnerabilities and weaknesses.