Document behavior if file validation fails must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-26616	DTOO292 - PowerPoint	SV-33869r1_rule	ECSC-1	Medium

Description
This policy key controls the behavior of how Office documents should be handled when failing File Validation. The options available are: -Block files completely. This will prevent users from opening files. -Open files in Protected View and disallow edit. This will prevent users from editing the files. -Open files in Protected view and allow edit. This will allow users to edit the files. If disabling or not configuring this policy setting, the default setting will be, "open files in protected view and allow edit".

Description

This policy key controls the behavior of how Office documents should be handled when failing File Validation. The options available are: -Block files completely. This will prevent users from opening files. -Open files in Protected View and disallow edit. This will prevent users from editing the files. -Open files in Protected view and allow edit. This will allow users to edit the files. If disabling or not configuring this policy setting, the default setting will be, "open files in protected view and allow edit".

STIG	Date
Microsoft PowerPoint 2010	2014-01-07

Details

Check Text ( C-34246r1_chk )
The policy value for User Configuration -> Administrative Templates -> Microsoft PowerPoint 2010 -> PowerPoint Options -> Security -> Trust Center -> Protected View “Set document behavior if file validation fails” must be "Enabled: Open in Protected View" and Unchecked for "Do not allow edit". Procedure: Use the Windows Registry Editor to navigate to the following keys: HKCU\Software\Policies\Microsoft\Office\14.0\powerpoint\security\filevalidation Criteria: If the value OpenInProtectedView is REG_DWORD = 1, this is not a finding. AND HKCU\Software\Policies\Microsoft\Office\14.0\powerpoint\security\filevalidation Criteria: If the value DisableEditFromPV is REG_DWORD = 1, this is not a finding.

Check Text ( C-34246r1_chk )

The policy value for User Configuration -> Administrative Templates -> Microsoft PowerPoint 2010 -> PowerPoint Options -> Security -> Trust Center -> Protected View “Set document behavior if file validation fails” must be "Enabled: Open in Protected View" and Unchecked for "Do not allow edit".

Procedure: Use the Windows Registry Editor to navigate to the following keys:

HKCU\Software\Policies\Microsoft\Office\14.0\powerpoint\security\filevalidation

Criteria: If the value OpenInProtectedView is REG_DWORD = 1, this is not a finding.

AND

HKCU\Software\Policies\Microsoft\Office\14.0\powerpoint\security\filevalidation

Criteria: If the value DisableEditFromPV is REG_DWORD = 1, this is not a finding.

Fix Text (F-29940r1_fix)
Set the policy value for User Configuration -> Administrative Templates -> Microsoft PowerPoint 2010 -> PowerPoint Options -> Security -> Trust Center -> Protected View “Set document behavior if file validation fails” to "Enabled: Open in Protected View" and Unchecked for "Do not allow edit".