Microsoft Windows 10

The Windows Defender SmartScreen for Explorer must be enabled

STIG ID: WN10-CC-000210 |   SRG: SRG-OS-000095-GPOS-00049 |   Severity: Medium |   CCI: CCI-000381 |   Vulnerability ID: V-220836

Description

Windows Defender SmartScreen helps protect systems from programs downloaded from the internet that may be malicious. Enabling Windows Defender SmartScreen will warn or prevent users from running potentially malicious programs.

Check

C-22551r554993_chk

This is applicable to unclassified systems, for other systems this is NA.If the following registry values do not exist or are not configured as specified, this is a finding:Registry Hive: HKEY_LOCAL_MACHINERegistry Path: \SOFTWARE\Policies\Microsoft\Windows\System\Value Name: EnableSmartScreenValue Type: REG_DWORDValue: 0x00000001 (1)AndRegistry Hive: HKEY_LOCAL_MACHINERegistry Path: \SOFTWARE\Policies\Microsoft\Windows\System\Value Name: ShellSmartScreenLevelValue Type: REG_SZValue: Blockv1607 LTSB:Registry Hive: HKEY_LOCAL_MACHINERegistry Path: \SOFTWARE\Policies\Microsoft\Windows\System\Value Name: EnableSmartScreenValue Type: REG_DWORDValue: 0x00000001 (1)v1507 LTSB:Registry Hive: HKEY_LOCAL_MACHINERegistry Path: \SOFTWARE\Policies\Microsoft\Windows\System\Value Name: EnableSmartScreenValue Type: REG_DWORDValue: 0x00000002 (2)

Fix

F-22540r554994_fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows Defender SmartScreen" to "Enabled" with "Warn and prevent bypass" selected. Windows 10 includes duplicate policies for this setting. It can also be configured under Computer Configuration >> Administrative Templates >> Windows Components >> Windows Defender SmartScreen >> Explorer.v1607 LTSB:Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled". (Selection options are not available.)v1507 LTSB:Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> File Explorer >> "Configure Windows SmartScreen" to "Enabled" with "Require approval from an administrator before running downloaded unknown software" selected.