Title

Internet Explorer is configured to notify users when programs are modified through the software distribution channel. (Cat III impact)

Discussion

Microsoft Internet Explorer now supports a software distribution channel that may be used to update software installed on a machine. If this setting is enabled, users will not be notified when programs are modified through the software distribution channel. This allows administrators to update workstations without user intervention.

Check Content

If the following registry value exists and its value is not set to 1, then this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Subkey: \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ Value Name: NoMSAppLogo5ChannelNotify Type: REG_DWORD Value: 1

Fix Text

Configure the policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer “Disable Software Update Shell Notifications on Program Launch” to “Enabled”.

Additional Identifiers

Rule ID: SV-3433r1_rule

Vulnerability ID: V-3433

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.