STIG V-224953 | Users must be prevented from changing...

Microsoft Windows Server 2016

Users must be prevented from changing installation options

STIG ID: WN16-CC-000450 | SRG: SRG-OS-000362-GPOS-00149 | Severity: Medium | CCI: CCI-001812 | Vulnerability ID: V-224953

Description

Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.

Check

If the following registry value does not exist or is not configured as specified, this is a finding.Registry Hive: HKEY_LOCAL_MACHINERegistry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\Value Name: EnableUserControlType: REG_DWORDValue: 0x00000000 (0)

Fix

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled".