Title

Upload method for publishing calendars to Office Online must be restricted. (Cat II impact)

Discussion

When users publish their calendar to Microsoft Office Online using the Microsoft Office Outlook Calendar Sharing Service, Outlook updates the calendars online at regular intervals unless they click Advanced and select Single Upload: Updates will not be uploaded from the Published Calendar Settings dialog box. If your organization has policies that govern the use of external resources such as Microsoft Office Online, allowing Outlook to publish calendar updates automatically might violate those policies.

Check Content

The policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Outlook Options -> Preferences -> Calendar Options -> Office.com Sharing Service “Restrict upload method” must be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\14.0\outlook\options\pubcal Criteria: If the value SingleUploadOnly is REG_DWORD = 1, this is not a finding.

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2010 -> Outlook Options -> Preferences -> Calendar Options -> Office.com Sharing Service “Restrict upload method” to “Enabled”.

Additional Identifiers

Rule ID: SV-33517r1_rule

Vulnerability ID: V-17777

Group Title: DTOO220 - Upload methods

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.