Title

The Publisher Automation Security Level must be configured for high security. (Cat II impact)

Discussion

This policy setting controls whether macros opened programmatically by another application can run in Publisher.If you enable this policy setting, you may choose an option for controlling macro behavior in Publisher when the application is opened programmatically:- Low (enabled): Macros can run in the programmatically opened application.- By UI (prompted): Macro functionality is determined by the setting in the "Macro Settings" section of the Trust Center.- High (disabled): All macros are disabled in the programmatically opened application.If you disable or do not configure this policy setting, Publisher will use the default Macro setting in Trust Center.

Check Content

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Publisher 2016 -> Security "Publisher Automation Security Level" is set to "Enabled and High (Disabled)" is selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKCU\Software\Policies\Microsoft\Office\Common\Security Criteria: If the value AutomationSecurityPublisher is REG_DWORD = 3, this is not a finding.

Fix Text

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Publisher 2016 -> Security "Publisher Automation Security Level" to "Enabled and High (Disabled)" is selected.

Additional Identifiers

Rule ID: SV-86299r1_rule

Vulnerability ID: V-71675

Group Title: SRG-APP-000210

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.