Title

Internet Explorer is configured to automatically check for updates. (Cat II impact)

Discussion

This setting determines whether or not Internet Explorer will periodically check the Microsoft web sites to determine if there are updates to Internet Explorer available. The SA should manually install all updates on a system so that configuration control is maintained.

Check Content

If the following registry value doesn’t exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Policies\Microsoft\Internet Explorer\InfoDelivery\Restrictions\ Value Name: NoUpdateCheck Type: REG_DWORD Value: 1

Fix Text

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Disable Periodic Check for Internet Explorer Software Updates” to “Enabled”.

Additional Identifiers

Rule ID: SV-3432r1_rule

Vulnerability ID: V-3432

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.