Title

Turn off configuring the update check interval is not disabled. (Cat II impact)

Discussion

This setting specifies the update check interval. The default value is 30 days. If you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval. If you disable or do not configure this policy setting, the user will have the freedom to configure the update check interval.

Check Content

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Turn off configuring the update check interval (in days)" will be set to “Enabled” and "30" selected from drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: If the value Update_Check_Interval is REG_DWORD = 30 (Decimal), this is not a finding.

Fix Text

The policy value for Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Settings -> Component Updates -> Periodic check for updates to Internet Explorer and Internet Tools -> "Turn off configuring the update check interval (in days)" will be set to “Enabled” and "30" selected from drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value Update_Check_Interval to REG_DWORD = 30 (Decimal).

Additional Identifiers

Rule ID: SV-16411r1_rule

Vulnerability ID: V-15564

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.