<?xml version="1.0" encoding="UTF-8"?>
<Benchmark xmlns="http://checklists.nist.gov/xccdf/1.1" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" id="IE8_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd">
  <status date="2014-09-30">draft</status>
  <title>Internet Explorer 8 STIG</title>
  <description>The Internet Explorer 8 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems. Registry paths and values identified in each control assume the use of Group Policy Administrative Templates. Installations not using Group Policies to administer Microsoft Browser products may observe alternate registry paths for stored configuration values.</description>
  <notice id="terms-of-use" xml:lang="en" />
  <reference>
    <dc:publisher>DISA, Field Security Operations</dc:publisher>
    <dc:source>STIG.DOD.MIL</dc:source>
  </reference>
  <plain-text id="release-info">Release: 15 Benchmark Date: 24 Oct 2014</plain-text>
  <platform idref="cpe:/a:microsoft:ie:8" />
  <version>1</version>
  <Profile id="MAC-1_Classified">
    <title>I - Mission Critical Classified</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-1_Public">
    <title>I - Mission Critical Public</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-1_Sensitive">
    <title>I - Mission Critical Sensitive</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-2_Classified">
    <title>II - Mission Support Classified</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-2_Public">
    <title>II - Mission Support Public</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-2_Sensitive">
    <title>II - Mission Support Sensitive</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-3_Classified">
    <title>III - Administrative Classified</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-3_Public">
    <title>III - Administrative Public</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Profile id="MAC-3_Sensitive">
    <title>III - Administrative Sensitive</title>
    <description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description>
    <select idref="V-3427" selected="true" />
    <select idref="V-3428" selected="true" />
    <select idref="V-3429" selected="true" />
    <select idref="V-3430" selected="true" />
    <select idref="V-6243" selected="true" />
    <select idref="V-6244" selected="true" />
    <select idref="V-6245" selected="true" />
    <select idref="V-6248" selected="true" />
    <select idref="V-6249" selected="true" />
    <select idref="V-6250" selected="true" />
    <select idref="V-6253" selected="true" />
    <select idref="V-6254" selected="true" />
    <select idref="V-6255" selected="true" />
    <select idref="V-6256" selected="true" />
    <select idref="V-6259" selected="true" />
    <select idref="V-6260" selected="true" />
    <select idref="V-6262" selected="true" />
    <select idref="V-6267" selected="true" />
    <select idref="V-6281" selected="true" />
    <select idref="V-6289" selected="true" />
    <select idref="V-6290" selected="true" />
    <select idref="V-6291" selected="true" />
    <select idref="V-6292" selected="true" />
    <select idref="V-6293" selected="true" />
    <select idref="V-6294" selected="true" />
    <select idref="V-6295" selected="true" />
    <select idref="V-6297" selected="true" />
    <select idref="V-6298" selected="true" />
    <select idref="V-6301" selected="true" />
    <select idref="V-6302" selected="true" />
    <select idref="V-6303" selected="true" />
    <select idref="V-6304" selected="true" />
    <select idref="V-6307" selected="true" />
    <select idref="V-6308" selected="true" />
    <select idref="V-6309" selected="true" />
    <select idref="V-6311" selected="true" />
    <select idref="V-7007" selected="true" />
    <select idref="V-14245" selected="true" />
    <select idref="V-15490" selected="true" />
    <select idref="V-15492" selected="true" />
    <select idref="V-15494" selected="true" />
    <select idref="V-15497" selected="true" />
    <select idref="V-15499" selected="true" />
    <select idref="V-15500" selected="true" />
    <select idref="V-15502" selected="true" />
    <select idref="V-15503" selected="true" />
    <select idref="V-15504" selected="true" />
    <select idref="V-15507" selected="true" />
    <select idref="V-15508" selected="true" />
    <select idref="V-15509" selected="true" />
    <select idref="V-15513" selected="true" />
    <select idref="V-15515" selected="true" />
    <select idref="V-15516" selected="true" />
    <select idref="V-15517" selected="true" />
    <select idref="V-15518" selected="true" />
    <select idref="V-15519" selected="true" />
    <select idref="V-15520" selected="true" />
    <select idref="V-15521" selected="true" />
    <select idref="V-15522" selected="true" />
    <select idref="V-15523" selected="true" />
    <select idref="V-15524" selected="true" />
    <select idref="V-15525" selected="true" />
    <select idref="V-15526" selected="true" />
    <select idref="V-15527" selected="true" />
    <select idref="V-15528" selected="true" />
    <select idref="V-15529" selected="true" />
    <select idref="V-15530" selected="true" />
    <select idref="V-15533" selected="true" />
    <select idref="V-15534" selected="true" />
    <select idref="V-15545" selected="true" />
    <select idref="V-15546" selected="true" />
    <select idref="V-15548" selected="true" />
    <select idref="V-15549" selected="true" />
    <select idref="V-15550" selected="true" />
    <select idref="V-15551" selected="true" />
    <select idref="V-15552" selected="true" />
    <select idref="V-15556" selected="true" />
    <select idref="V-15557" selected="true" />
    <select idref="V-15558" selected="true" />
    <select idref="V-15559" selected="true" />
    <select idref="V-15560" selected="true" />
    <select idref="V-15561" selected="true" />
    <select idref="V-15562" selected="true" />
    <select idref="V-15563" selected="true" />
    <select idref="V-15564" selected="true" />
    <select idref="V-15565" selected="true" />
    <select idref="V-15566" selected="true" />
    <select idref="V-15568" selected="true" />
    <select idref="V-15569" selected="true" />
    <select idref="V-15570" selected="true" />
    <select idref="V-15571" selected="true" />
    <select idref="V-15572" selected="true" />
    <select idref="V-15579" selected="true" />
    <select idref="V-15603" selected="true" />
    <select idref="V-15604" selected="true" />
    <select idref="V-17296" selected="true" />
    <select idref="V-21887" selected="true" />
    <select idref="V-22108" selected="true" />
    <select idref="V-22147" selected="true" />
    <select idref="V-22148" selected="true" />
    <select idref="V-22149" selected="true" />
    <select idref="V-22150" selected="true" />
    <select idref="V-22152" selected="true" />
    <select idref="V-22153" selected="true" />
    <select idref="V-22154" selected="true" />
    <select idref="V-22155" selected="true" />
    <select idref="V-22156" selected="true" />
    <select idref="V-22157" selected="true" />
    <select idref="V-22158" selected="true" />
    <select idref="V-22159" selected="true" />
    <select idref="V-22160" selected="true" />
    <select idref="V-22161" selected="true" />
    <select idref="V-22171" selected="true" />
    <select idref="V-22634" selected="true" />
    <select idref="V-22635" selected="true" />
    <select idref="V-22636" selected="true" />
    <select idref="V-22637" selected="true" />
    <select idref="V-22638" selected="true" />
    <select idref="V-22687" selected="true" />
    <select idref="V-22688" selected="true" />
    <select idref="V-30777" selected="true" />
    <select idref="V-30778" selected="true" />
    <select idref="V-30779" selected="true" />
    <select idref="V-30780" selected="true" />
    <select idref="V-30781" selected="true" />
  </Profile>
  <Value id="UseOnlyMachineSettings_LocalComputer_var" type="number" operator="equals">
    <title>UseOnlyMachineSettings_LocalComputer_var</title>
    <description>UseOnlyMachineSettings_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="DoNotAllowUsersChangePolicies_LocalComputer_var" type="number" operator="equals">
    <title>DoNotAllowUsersChangePolicies_LocalComputer_var</title>
    <description>DoNotAllowUsersChangePolicies_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="DoNotAllowUsersAddDeleteSites_LocalComputer_var" type="number" operator="equals">
    <title>DoNotAllowUsersAddDeleteSites_LocalComputer_var</title>
    <description>DoNotAllowUsersAddDeleteSites_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="MakeProxySettingsPerMachine_LocalComputer_var" type="number" operator="equals">
    <title>MakeProxySettingsPerMachine_LocalComputer_var</title>
    <description>MakeProxySettingsPerMachine_LocalComputer_var</description>
    <value>1</value>
    <value selector="disabled">1</value>
    <value selector="enabled">0</value>
  </Value>
  <Value id="DownloadSignedActiveXControls_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>DownloadSignedActiveXControls_InternetZone_LocalComputer_var</title>
    <description>DownloadSignedActiveXControls_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var</title>
    <description>DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var</title>
    <description>InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowFontDownloads_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowFontDownloads_InternetZone_LocalComputer_var</title>
    <description>AllowFontDownloads_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var</title>
    <description>AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var</title>
    <description>AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var</title>
    <description>AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var</title>
    <description>LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="UserdataPersistence_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>UserdataPersistence_InternetZone_LocalComputer_var</title>
    <description>UserdataPersistence_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var</title>
    <description>AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LogonOptions_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>LogonOptions_InternetZone_LocalComputer_var</title>
    <description>LogonOptions_InternetZone_LocalComputer_var</description>
    <value>65536</value>
    <value selector="enabled:automatic_logon_with_current_user_name_and_password">0</value>
    <value selector="enabled:prompt_for_user_name_and_password">65536</value>
    <value selector="enabled:automatic_logon_only_in_IntranetZone">131072</value>
    <value selector="enabled:anonymous_logon">196608</value>
  </Value>
  <Value id="DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var</title>
    <description>DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var</title>
    <description>DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var</title>
    <description>InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var</title>
    <description>RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var</title>
    <description>ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowFileDownloads_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowFileDownloads_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowFileDownloads_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowFontDownloads_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowFontDownloads_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowFontDownloads_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var</title>
    <description>AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var</title>
    <description>LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var</title>
    <description>NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="UserdataPersistence_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>UserdataPersistence_RestrictedSitesZone_LocalComputer_var</title>
    <description>UserdataPersistence_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowActiveScripting_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowActiveScripting_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowActiveScripting_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LogonOptions_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>LogonOptions_RestrictedSitesZone_LocalComputer_var</title>
    <description>LogonOptions_RestrictedSitesZone_LocalComputer_var</description>
    <value>196608</value>
    <value selector="enabled:automatic_logon_with_current_user_name_and_password">0</value>
    <value selector="enabled:prompt_for_user_name_and_password">65536</value>
    <value selector="enabled:automatic_logon_only_in_IntranetZone">131072</value>
    <value selector="enabled:anonymous_logon">196608</value>
  </Value>
  <Value id="JavaPermissions_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_RestrictedSitesZone_LocalComputer_var</title>
    <description>JavaPermissions_RestrictedSitesZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="DisableChangingAutomaticConfigurationSettings_LocalComputer_var" type="number" operator="equals">
    <title>DisableChangingAutomaticConfigurationSettings_LocalComputer_var</title>
    <description>DisableChangingAutomaticConfigurationSettings_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="TurnOffSecuritySettingsCheckFeature_LocalComputer_var" type="number" operator="equals">
    <title>TurnOffSecuritySettingsCheckFeature_LocalComputer_var</title>
    <description>TurnOffSecuritySettingsCheckFeature_LocalComputer_var</description>
    <value>0</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="AllowActiveContentFromCD_LocalComputer_var" type="number" operator="equals">
    <title>Allow active content from CDs to run on user machines - Local Computer - variable</title>
    <description>Allow Active Content from CDs to Run on User Machine - Local Computer - variable</description>
    <value>0</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="AllowSoftwareRunInstallSignatureInvalid_LocalComputer_var" type="number" operator="equals">
    <title>Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable</title>
    <description>Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable</description>
    <value>0</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="AllowThird-PartyBrowserExtensions_LocalComputer_var" type="string" operator="equals">
    <title>Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable</title>
    <description>Allow Software to Run or Install Even if the Signature is Invalid - Local Computer - variable</description>
    <value>no</value>
    <value selector="disabled">no</value>
    <value selector="enabled">yes</value>
  </Value>
  <Value id="CheckServerCertificateRevocation_LocalComputer_var" type="number" operator="equals">
    <title>Check for Server Certificate Revocation - Local Computer - variable</title>
    <description>Check for Server Certificate Revocation - Local Computer - variable</description>
    <value>1</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="CheckSignatureDownloadedPrograms_LocalComputer_var" type="string" operator="equals">
    <title>Check for signatures on downloaded programs - Local Computer - variable</title>
    <description>Check for Signature on Downloaded Programs - Local Computer - variable</description>
    <value>yes</value>
    <value selector="disabled">no</value>
    <value selector="enabled">yes</value>
  </Value>
  <Value id="IncludeAllNetworkPaths_LocalComputer_var" type="number" operator="equals">
    <title>IncludeAllNetworkPaths_LocalComputer_var</title>
    <description>IncludeAllNetworkPaths_LocalComputer_var</description>
    <value>0</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var</title>
    <description>AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowScriptlets_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowScriptlets_InternetZone_LocalComputer_var</title>
    <description>AllowScriptlets_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var</title>
    <description>AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="JavaPermissions_LocalMachineZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_LocalMachineZone_LocalComputer_var</title>
    <description>JavaPermissions_LocalMachineZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="USGCB">0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var</title>
    <description>JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="JavaPermissions_LockedDownIntranetZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_LockedDownIntranetZone_LocalComputer_var</title>
    <description>JavaPermissions_LockedDownIntranetZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var</title>
    <description>JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="JavaPermissions_LockedDownInternetZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_LockedDownInternetZone_LocalComputer_var</title>
    <description>todo - description needed</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var</title>
    <description>JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="LooseXAMLFiles_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>LooseXAMLFiles_InternetZone_LocalComputer_var</title>
    <description>LooseXAMLFiles_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var</title>
    <description>LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="OpenFilesBasedOnContent_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>OpenFilesBasedOnContent_InternetZone_LocalComputer_var</title>
    <description>OpenFilesBasedOnContent_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var</title>
    <description>OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="TurnOffFirstRunOptIn_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>TurnOffFirstRunOptIn_InternetZone_LocalComputer_var</title>
    <description>todo - description needed</description>
    <value>0</value>
    <value selector="enabled:disable">0</value>
    <value selector="enabled:enable">3</value>
  </Value>
  <Value id="TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var</title>
    <description>TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable">0</value>
    <value selector="enabled:enable">3</value>
  </Value>
  <Value id="TurnOnProtectedMode_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>TurnOnProtectedMode_InternetZone_LocalComputer_var</title>
    <description>todo - description needed</description>
    <value>0</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="TurnOnProtectedMode_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>TurnOnProtectedMode_RestrictedSitesZone_LocalComputer_var</title>
    <description>todo - description needed</description>
    <value>0</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="UsePop-upBlocker_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>UsePop-upBlocker_InternetZone_LocalComputer_var</title>
    <description>UsePop-upBlocker_InternetZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var</title>
    <description>UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var</title>
    <description>WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var</title>
    <description>WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var</title>
    <description>RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var</title>
    <description>RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var</title>
    <description>ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="TurnOffConfiguringUpdateCheckInterval_LocalComputer_var" type="number" operator="equals">
    <title>TurnOffConfiguringUpdateCheckInterval_LocalComputer_var</title>
    <description>TurnOffConfiguringUpdateCheckInterval_LocalComputer_var</description>
    <value>30</value>
    <value selector="30_days">30</value>
  </Value>
  <Value id="TurnOffCrashDetection_LocalComputer_var" type="number" operator="equals">
    <title>TurnOffCrashDetection_LocalComputer_var</title>
    <description>TurnOffCrashDetection_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var" type="number" operator="equals">
    <title>PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var</title>
    <description>PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled:home_page">1</value>
    <value selector="enabled:welcome_page">2</value>
  </Value>
  <Value id="TurnoffManagingSmartScreenFilter_LocalComputer_var" type="number" operator="equals">
    <title>TurnoffManagingSmartScreenFilter_LocalComputer_var</title>
    <description>TurnoffManagingSmartScreenFilter_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:off">0</value>
    <value selector="enabled:on">1</value>
  </Value>
  <Value id="IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var" type="number" operator="equals">
    <title>IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var</title>
    <description>IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var</description>
    <value>0</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var" type="number" operator="equals">
    <title>ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var</title>
    <description>ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var</description>
    <value>0</value>
    <value selector="disabled">0</value>
    <value selector="enabled">1</value>
  </Value>
  <Value id="PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var" type="number" operator="equals">
    <title>PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var</title>
    <description>PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var</description>
    <value>0</value>
    <value selector="disabled">1</value>
    <value selector="enabled">0</value>
  </Value>
  <Value id="TurnOffInPrivateBrowsing_LocalComputer_var" type="number" operator="equals">
    <title>TurnOffInPrivateBrowsing_LocalComputer_var</title>
    <description>TurnOffInPrivateBrowsing_LocalComputer_var</description>
    <value>0</value>
    <value selector="disabled">1</value>
    <value selector="enabled">0</value>
  </Value>
  <Value id="AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var</title>
    <description>AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var</title>
    <description>IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var</title>
    <description>LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var</title>
    <description>OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">3</value>
    <value selector="enabled:disable">0</value>
  </Value>
  <Value id="AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var</title>
    <description>IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var</title>
    <description>LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var</title>
    <description>OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">3</value>
    <value selector="enabled:disable">0</value>
  </Value>
  <Value id="TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var</title>
    <description>TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var</title>
    <description>RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var</title>
    <description>RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowScriptlets_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowScriptlets_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowScriptlets_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="JavaPermissions_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_InternetZone_LocalComputer_var</title>
    <description>JavaPermissions_InternetZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="NavigateSubFramesAcrossDifferentDomains_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>NavigateSubFramesAcrossDifferentDomains_InternetZone_LocalComputer_var</title>
    <description>NavigateSubFramesAcrossDifferentDomains_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:prompt">1</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="JavaPermissions_IntranetZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_IntranetZone_LocalComputer_var</title>
    <description>JavaPermissions_IntranetZone_LocalComputer_var</description>
    <value>65536</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="JavaPermissions_TrustedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>JavaPermissions_TrustedSitesZone_LocalComputer_var</title>
    <description>JavaPermissions_TrustedSitesZone_LocalComputer_var</description>
    <value>65536</value>
    <value selector="enabled:disable-java">0</value>
    <value selector="enabled:high-safety">65536</value>
    <value selector="enabled:medium-safety">131072</value>
    <value selector="enabled:low-safety">196608</value>
    <value selector="enabled:custom">8388608</value>
  </Value>
  <Value id="DoNotAllowUsersEnableDisableAddOns_LocalComputer_var" type="number" operator="equals">
    <title>DoNotAllowUsersEnableDisableAddOns_LocalComputer_var</title>
    <description>DoNotAllowUsersEnableDisableAddOns_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var</title>
    <description>AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="InternetExplorerMimeHandling_FeatureControl_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorerMimeHandling_FeatureControl_LocalComputer_var</title>
    <description>InternetExplorerMimeHandling_FeatureControl_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorerMimeSniffing_InternetExplorerProcesses_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorerMimeSniffing_InternetExplorerProcesses_LocalComputer_var</title>
    <description>InternetExplorerMimeSniffing_InternetExplorerProcesses_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorerMkProtocol_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorerMkProtocol_Explorer_LocalComputer_var</title>
    <description>InternetExplorerMkProtocol_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorerMkProtocol_Iexplore_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorerMkProtocol_Iexplore_LocalComputer_var</title>
    <description>InternetExplorerMkProtocol_Iexplore_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorer_ZoneElevation_Reserved_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorer_ZoneElevation_Reserved_LocalComputer_var</title>
    <description>InternetExplorer_ZoneElevation_Reserved_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorer_DownloadPrompt_RestrictFileDownload_Reserved_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorer_DownloadPrompt_RestrictFileDownload_Reserved_LocalComputer_var</title>
    <description>InternetExplorer_DownloadPrompt_RestrictFileDownload_Reserved_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorer_DownloadPrompt_RestrictFileDownload_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorer_DownloadPrompt_RestrictFileDownload_Explorer_LocalComputer_var</title>
    <description>InternetExplorer_DownloadPrompt_RestrictFileDownload_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorer_DownloadPrompt_RestrictFileDownload_Iexplorer_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorer_DownloadPrompt_RestrictFileDownload_Iexplorer_LocalComputer_var</title>
    <description>InternetExplorer_DownloadPrompt_RestrictFileDownload_Iexplorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="InternetExplorer_PopUpRestricting_Reserved_LocalComputer_var" type="number" operator="equals">
    <title>InternetExplorer_PopUpRestricting_Reserved_LocalComputer_var</title>
    <description>InternetExplorer_PopUpRestricting_Reserved_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="TurnOffChangingURLDisplay_LocalComputer_var" type="string" operator="equals">
    <title>TurnOffChangingURLDisplay_LocalComputer_var</title>
    <description>TurnOffChangingURLDisplay_LocalComputer_var</description>
    <value />
    <value selector="enabled:" />
  </Value>
  <Value id="IEProcesses_MimeHandling_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_MimeHandling_Explorer_LocalComputer_var</title>
    <description>IEProcesses_MimeHandling_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_MimeHandling_Iexplorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_MimeHandling_Iexplorer_LocalComputer_var</title>
    <description>IEProcesses_MimeHandling_Iexplorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_MkProtocol_Reserved_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_MkProtocol_Reserved_LocalComputer_var</title>
    <description>IEProcesses_MkProtocol_Reserved_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_ZoneElevation_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_ZoneElevation_Explorer_LocalComputer_var</title>
    <description>IEProcesses_ZoneElevation_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_ZoneElevation_Iexplorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_ZoneElevation_Iexplorer_LocalComputer_var</title>
    <description>IEProcesses_ZoneElevation_Iexplorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_PopUpRestricting_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_PopUpRestricting_Explorer_LocalComputer_var</title>
    <description>IEProcesses_PopUpRestricting_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_PopUpRestricting_Iexplorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_PopUpRestricting_Iexplorer_LocalComputer_var</title>
    <description>IEProcesses_PopUpRestricting_Iexplorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_MimeSniffing_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_MimeSniffing_Explorer_LocalComputer_var</title>
    <description>IEProcesses_MimeSniffing_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcesses_MimeSniffing_Iexplorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcesses_MimeSniffing_Iexplorer_LocalComputer_var</title>
    <description>IEProcesses_MimeSniffing_Iexplorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="DisableConfigHistorySetting_LocalComputer_var" type="number" operator="equals">
    <title>DisableConfigHistorySetting_LocalComputer_var</title>
    <description>DisableConfigHistorySetting_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="TurnonCrossSiteScriptingFilter_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>TurnonCrossSiteScriptingFilter_InternetZone_LocalComputer_var</title>
    <description>TurnonCrossSiteScriptingFilter_InternetZone_LocalComputer_var</description>
    <value>0</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="IEProcessesRestrictActiveX_Reserved_LocalComputer_var" type="number" operator="equals">
    <title>IEProcessesRestrictActiveX_Reserved_LocalComputer_var</title>
    <description>IEProcessesRestrictActiveX_Reserved_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="AllowStatusBarUpdates_InternetZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowStatusBarUpdates_InternetZone_LocalComputer_var</title>
    <description>AllowStatusBarUpdates_InternetZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="AllowStatusBarUpdates_RestrictedSitesZone_LocalComputer_var" type="number" operator="equals">
    <title>AllowStatusBarUpdates_RestrictedSitesZone_LocalComputer_var</title>
    <description>AllowStatusBarUpdates_RestrictedSitesZone_LocalComputer_var</description>
    <value>3</value>
    <value selector="enabled:enable">0</value>
    <value selector="enabled:disable">3</value>
  </Value>
  <Value id="IEProcessesRestrictActiveX_Explorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcessesRestrictActiveX_Explorer_LocalComputer_var</title>
    <description>IEProcessesRestrictActiveX_Explorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Value id="IEProcessesRestrictActiveX_Iexplorer_LocalComputer_var" type="number" operator="equals">
    <title>IEProcessesRestrictActiveX_Iexplorer_LocalComputer_var</title>
    <description>IEProcessesRestrictActiveX_Iexplorer_LocalComputer_var</description>
    <value>1</value>
    <value selector="enabled">1</value>
    <value selector="disabled">0</value>
  </Value>
  <Group id="V-3427">
    <title>DTBI320 - Security zone machine settings</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25182r1_rule" severity="medium" weight="10.0">
      <version>DTBI320</version>
      <title>Internet Explorer is not configured to require consistent security zone settings to all users.</title>
      <description>&lt;VulnDiscussion&gt;This setting enforces consistent security zone settings to all users of the computer.  Security zones control browser behavior at various web sites and it is desirable to maintain a consistent policy for all users of a machine.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;HK&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10096-6</ident>
      <fixtext fixref="F-26928r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer “Security Zones: Use only machine settings” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: Set the value Security_HKLM_only to REG_DWORD = 1.</fixtext>
      <fix id="F-26928r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="UseOnlyMachineSettings_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:3" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-3428">
    <title>DTBI319 - Changing of policies</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25181r1_rule" severity="medium" weight="10.0">
      <version>DTBI319</version>
      <title>Internet Explorer is configured to allow users to change policies.</title>
      <description>&lt;VulnDiscussion&gt;This setting prevents users from changing the Internet Explorer policies on the machine.  Policy changes should be made by administrators only, so this setting should be enabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;HK&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10037-0</ident>
      <fixtext fixref="F-26929r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer “Security Zones: Do not allow users to change policies” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: Set the value Security_options_edit to REG_DWORD = 1.</fixtext>
      <fix id="F-26929r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DoNotAllowUsersChangePolicies_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:4" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-3429">
    <title>DTBI318 - Addition and deletion of sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25180r1_rule" severity="medium" weight="10.0">
      <version>DTBI318</version>
      <title>Internet Explorer is configured to allow users to add/delete sites.</title>
      <description>&lt;VulnDiscussion&gt;This setting prevents users from adding sites to various security zones.  Users should not be able to add sites to different zones, as this could allow them to bypass security controls of the system.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;HK&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10394-5</ident>
      <fixtext fixref="F-26930r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer “Security Zones: Do not allow users to add/delete sites” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: Set the value Security_zones_map_edit to REG_DWORD = 1.</fixtext>
      <fix id="F-26930r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DoNotAllowUsersAddDeleteSites_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:5" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-3430">
    <title>DTBI367 - Proxy settings</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25555r1_rule" severity="low" weight="10.0">
      <version>DTBI367</version>
      <title>Internet Explorer is not configured to disable making Proxy Settings Per Machine.</title>
      <description>&lt;VulnDiscussion&gt;This setting controls whether or not the Internet Explorer proxy settings are configured on a per-user or per-machine basis.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9870-7</ident>
      <fixtext fixref="F-23137r1_fix">Configure the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer “Make proxy settings per-machine (rather than per user)” to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ Criteria: Set the value ProxySettingsPerUser to REG_DWORD = 1.</fixtext>
      <fix id="F-23137r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="MakeProxySettingsPerMachine_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:6" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6243">
    <title>DTBI022 - Download signed ActiveX - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25613r1_rule" severity="medium" weight="10.0">
      <version>DTBI022</version>
      <title>The Download signed ActiveX controls property is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9917-6</ident>
      <fixtext fixref="F-23195r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Download signed ActiveX controls" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria:Set the value 1001 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23195r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DownloadSignedActiveXControls_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:7" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6244">
    <title>DTBI023 - Download unsigned ActiveX - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25615r1_rule" severity="medium" weight="10.0">
      <version>DTBI023</version>
      <title>The Download unsigned ActiveX controls property is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Active X controls can contain potentially malicious code and must only be allowed to be downloaded from trusted sites and they must be digitally signed.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10433-1</ident>
      <fixtext fixref="F-23197r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Download unsigned ActiveX controls" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1004 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23197r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DownloadUnsignedActiveXControls_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:8" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6245">
    <title>DTBI024 - Initialize and script ActiveX - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25616r1_rule" severity="medium" weight="10.0">
      <version>DTBI024</version>
      <title>The Initialize and script ActiveX controls not marked as safe property is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;ActiveX controls that are not marked safe scripting should not be executed.  Although this is not a complete security measure for a control to be marked safe for scripting, if a control is not marked safe, it should not be initialized and executed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10561-9</ident>
      <fixtext fixref="F-23198r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: If the value 1201 is REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23198r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InitializeScriptActiveXControlsNotMarkedAsSafe_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:9" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6248">
    <title>DTBI030-Font download control - Internet Zone</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25609r1_rule" severity="medium" weight="10.0">
      <version>DTBI030</version>
      <title>The Font download control is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Download of fonts can sometimes contain malicious code.  &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10403-4</ident>
      <fixtext fixref="F-23191r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Allow font downloads" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3.  Criteria: Set the value 1604 to REG_DWORD = 3.</fixtext>
      <fix id="F-23191r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowFontDownloads_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:10" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6249">
    <title>DTBI031 - Java Permission - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25618r1_rule" severity="medium" weight="10.0">
      <version>DTBI031</version>
      <title>The Java Permissions is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Java must have levels of protection based upon the site being browsed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10182-4</ident>
      <fixtext fixref="F-23200r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1C00 to REG_DWORD = 0 (Disabled = 0).</fixtext>
      <fix id="F-23200r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:22800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:228" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6250">
    <title>DTBI032 - Data sources across domains - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25606r1_rule" severity="medium" weight="10.0">
      <version>DTBI032</version>
      <title>The Access data sources across domains is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Access to data sources across multiple domains must be controlled based upon the site being browsed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10380-4</ident>
      <fixtext fixref="F-23188r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Access data sources across domains" will be set to "Enabled" and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1406 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23188r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AccessDataSourcesAcrossDomains_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:11" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6253">
    <title>DTBI036-Drag and drop or copy and paste-Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25608r1_rule" severity="medium" weight="10.0">
      <version>DTBI036</version>
      <title>The Allow Drag and drop or copy and paste files is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Drag and Drop or copy and paste files must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10033-9</ident>
      <fixtext fixref="F-23190r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Allow drag and drop or copy and paste files" will be set to “Enabled” and "Disable".  If a value for this zone is present and not set to 3, change the registry key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1802 to REG_DWORD = 3 (Disable= 3).</fixtext>
      <fix id="F-23190r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowDragDropOrCopyPasteFiles_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:12" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6254">
    <title>DTBI037-Installation of desktop items - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25610r1_rule" severity="medium" weight="10.0">
      <version>DTBI037</version>
      <title>The Installation of desktop items is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Installation of items must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9790-7</ident>
      <fixtext fixref="F-23192r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Allow installation of desktop items" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1800 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23192r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowInstallationOfDesktopItems_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:13" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6255">
    <title>DTBI038 - Programs and files in IFRAME - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25619r1_rule" severity="medium" weight="10.0">
      <version>DTBI038</version>
      <title>The Launching programs and files in IFRAME are not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Launching of programs in IFRAME must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9821-0</ident>
      <fixtext fixref="F-23201r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Launching applications and files in an IFRAME" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1804 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23201r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LaunchingApplicationsAndFilesInIFRAME_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:14" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6256">
    <title>DTBI039 - Navigating across domains - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25624r1_rule" severity="medium" weight="10.0">
      <version>DTBI039</version>
      <title>The Navigate windows and frames across different domains is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Frames that navigate across different domains are a security concern, because the user may think they are accessing pages on one site while they are actually accessing pages on another site.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9865-7</ident>
      <fixtext fixref="F-28579r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Navigate windows and frames across different domains" will be set to “Enabled” and "Disable". Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1607 to REG_DWORD = 3.</fixtext>
      <fix id="F-28579r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="NavigateSubFramesAcrossDifferentDomains_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:22900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:229" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6259">
    <title>DTBI042-Userdata persistence - Internet Zone</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25626r1_rule" severity="medium" weight="10.0">
      <version>DTBI042</version>
      <title>The Userdata persistence is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Userdata persistence must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10200-4</ident>
      <fixtext fixref="F-23208r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt;  “Userdata persistence” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1606 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23208r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="UserdataPersistence_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:16" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6260">
    <title>DTBI044 - Paste operations via script - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25607r1_rule" severity="medium" weight="10.0">
      <version>DTBI044</version>
      <title>The Allow paste operations via script is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Allow paste operations via script must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10002-4</ident>
      <fixtext fixref="F-23189r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Allow cut, copy or paste operations from the clipboard via script" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1407 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23189r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowCutCopyPasteOperationsFromClipboardViaScript_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:17" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6262">
    <title>DTBI046-User Authentication-Logon - Internet Zone</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25622r1_rule" severity="medium" weight="10.0">
      <version>DTBI046</version>
      <title>The user Authentication - Logon is not set properly for the Internet Zone.</title>
      <description>&lt;VulnDiscussion&gt;Care must be taken with user credentials and how automatic logons are performed and how default Windows credentials are passed to web sites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10472-9</ident>
      <fixtext fixref="F-23204r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Logon options" will be set to “Enabled” and "Prompt for user name and password".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1A00 to REG_DWORD = 65536 (decimal).</fixtext>
      <fix id="F-23204r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LogonOptions_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:18" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6267">
    <title>DTBI061 - Java Permission - Intranet Zone</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25627r1_rule" severity="medium" weight="10.0">
      <version>DTBI061</version>
      <title>The Java Permissions is not set properly for the Local Zone.</title>
      <description>&lt;VulnDiscussion&gt;Java must have a level of protection based upon the site being browsed.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10566-8</ident>
      <fixtext fixref="F-23209r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Intranet Zone -&gt; “Java permissions” will be set to “Enabled” and “High Safety”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Criteria: Set the value 1C00 to REG_DWORD = 65536, (High Safety).</fixtext>
      <fix id="F-23209r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_IntranetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:230" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6281">
    <title>DTBI091- Java Permission - Trusted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25647r1_rule" severity="medium" weight="10.0">
      <version>DTBI091</version>
      <title>The Java Permissions is not set properly for the Trusted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Java must have a level of protection based upon the site being browsed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10696-3</ident>
      <fixtext fixref="F-23229r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Trusted Sites Zone -&gt; "Java permissions" will be set to “Enabled” and "High Safety".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Criteria: Set the value 1C00 to REG_DWORD = 65536, (High Safety).</fixtext>
      <fix id="F-23229r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_TrustedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:231" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6289">
    <title>DTBI112-Download signed ActiveX - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25636r1_rule" severity="medium" weight="10.0">
      <version>DTBI112</version>
      <title>The Download signed ActiveX controls property is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from  trusted sites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10470-3</ident>
      <fixtext fixref="F-23218r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Download signed ActiveX controls" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1001 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23218r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DownloadSignedActiveXControls_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:1900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:19" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6290">
    <title>DTBI113 - Download unsigned ActiveX - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25637r1_rule" severity="medium" weight="10.0">
      <version>DTBI113</version>
      <title>The Download unsigned ActiveX controls property is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;ActiveX controls can contain potentially malicious code and must only be allowed to be downloaded from  trusted sites and they must be digitally signed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10461-2</ident>
      <fixtext fixref="F-23219r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Download unsigned ActiveX controls" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1004 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23219r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DownloadUnsignedActiveXControls_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:20" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6291">
    <title>DTBI114 - Initialize and script ActiveX-Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25638r1_rule" severity="medium" weight="10.0">
      <version>DTBI114</version>
      <title>The Initialize and script ActiveX controls not marked as safe property is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;ActiveX controls that are not marked safe for scripting should not be executed.  Although this is not a 
complete security measure for a control to be marked safe for scripting, if a control is not marked 
safe, it should not be initialized and executed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10347-3</ident>
      <fixtext fixref="F-23220r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Initialize and script ActiveX controls not marked as safe" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1201 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23220r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InitializeScriptActiveXControlsNotMarkedAsSafe_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:21" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6292">
    <title>DTBI115 - ActiveX control and plugins - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25643r1_rule" severity="medium" weight="10.0">
      <version>DTBI115</version>
      <title>Run ActiveX controls and plug-ins property is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;ActiveX controls that are not marked safe for scripting should not be executed.  Although this is not a 
complete security measure for a control to be marked safe for scripting, if a control is not marked 
safe, it should not be initialized and executed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9792-3</ident>
      <fixtext fixref="F-23225r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Run ActiveX controls and plugins" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1200 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23225r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="RunActiveXControlsAndPlugins_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:22" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6293">
    <title>DTBI116 - ActiveX control marked safe - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25644r1_rule" severity="medium" weight="10.0">
      <version>DTBI116</version>
      <title>The Script ActiveX controls marked safe for scripting property is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;ActiveX controls that are not marked safe for scripting should not be executed.  Although this is not a 
complete security measure for a control to be marked safe for scripting, if a control is not marked 
safe, it should not be initialized and executed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10554-4</ident>
      <fixtext fixref="F-23226r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Script ActiveX controls marked safe for scripting" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1405 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23226r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="ScriptActiveXControlsMarkedSafeForScripting_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:23" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6294">
    <title>DTBI119-File download control - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25632r1_rule" severity="medium" weight="10.0">
      <version>DTBI119</version>
      <title>The File download control is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Files should not be able to be downloaded from sites that are considered restricted.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10466-1</ident>
      <fixtext fixref="F-23214r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Allow file downloads" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1803 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23214r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowFileDownloads_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:24" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6295">
    <title>DTBI120-Font download control - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25633r1_rule" severity="medium" weight="10.0">
      <version>DTBI120</version>
      <title>The Font download control is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Download of fonts can sometimes contain malicious code.    Files should not be downloaded from restricted sites.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9982-0</ident>
      <fixtext fixref="F-23215r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Allow font downloads” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1604 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23215r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowFontDownloads_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:25" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6297">
    <title>DTBI122-Access data sources - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25628r1_rule" severity="medium" weight="10.0">
      <version>DTBI122</version>
      <title>The Access data sources across domains is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;The restricted zones is used for MS Outlook.  This zone must be set properly to ensure Outlook is secured.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10525-4</ident>
      <fixtext fixref="F-23210r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Access data sources across domains” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1406 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23210r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AccessDataSourcesAcrossDomains_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:26" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6298">
    <title>DTBI123 - META REFRESH - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25635r1_rule" severity="medium" weight="10.0">
      <version>DTBI123</version>
      <title>The Allow  META REFRESH is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Allow  META REFRESH  must have a level of protection based upon the site being browsed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10664-1</ident>
      <fixtext fixref="F-23217r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Allow META REFRESH” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1608 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23217r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowMETAREFRESH_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:27" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6301">
    <title>DTBI126-Drag and drop or copy and paste-Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25631r1_rule" severity="medium" weight="10.0">
      <version>DTBI126</version>
      <title>The Drag and drop or copy and paste files is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Drag and Drop of files must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9667-7</ident>
      <fixtext fixref="F-23213r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Allow drag and drop or copy and paste files" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1802 to REG_DWORD=3 (Disabled).</fixtext>
      <fix id="F-23213r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowDragDropOrCopyPasteFiles_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:28" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6302">
    <title>DTBI127-Installation of desktop items - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25634r1_rule" severity="medium" weight="10.0">
      <version>DTBI127</version>
      <title>The Installation of desktop items is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Installation of items must have level of protection based upon the site being accessed. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10475-2</ident>
      <fixtext fixref="F-23216r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Allow installation of desktop items” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1800 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23216r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowInstallationOfDesktopItems_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:2900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:29" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6303">
    <title>DTBI128 - Programs and files in IFRAME-Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25640r1_rule" severity="medium" weight="10.0">
      <version>DTBI128</version>
      <title>The Launching programs and files in IFRAME is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Launching of programs in IFRAME must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10360-6</ident>
      <fixtext fixref="F-23222r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Launching applications and files in an IFRAME" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1804 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23222r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LaunchingApplicationsAndFilesInIFRAME_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:30" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6304">
    <title>DTBI129 - Navigating across domains - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25642r1_rule" severity="medium" weight="10.0">
      <version>DTBI129</version>
      <title>The Navigate windows and frames across different domains are not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Frames that navigate across different domains are a security concern, because users may think they are accessing pages on one site while they are actually accessing pages on another site.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10642-7</ident>
      <fixtext fixref="F-23224r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Navigate windows and frames across different domains" will be set to “Enabled” and "Disable".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1607 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23224r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="NavigateSub-framesAcrossDifferentDomains_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:31" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6307">
    <title>DTBI132-Userdata persistence - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25646r1_rule" severity="medium" weight="10.0">
      <version>DTBI132</version>
      <title>The Userdata persistence is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;No persistence data should exist and be used in the Restricted Sites Zone. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9760-0</ident>
      <fixtext fixref="F-23228r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Userdata persistence” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1606 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23228r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="UserdataPersistence_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:33" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6308">
    <title>DTBI133-Active scripting - Restricted Sites</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25629r1_rule" severity="medium" weight="10.0">
      <version>DTBI133</version>
      <title>The Active scripting is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Active scripting must have a level of protection based upon the site being accessed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10393-7</ident>
      <fixtext fixref="F-23211r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Allow active scripting” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1400 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23211r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowActiveScripting_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:34" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6309">
    <title>DTBI134 - Paste operations via script - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25630r1_rule" severity="medium" weight="10.0">
      <version>DTBI134</version>
      <title>The Allow paste operations via script is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;The Allow paste operations via script must have a level of protection based upon the site being browsed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10539-5</ident>
      <fixtext fixref="F-23212r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Allow cut, copy or paste operations from the clipboard via script” will be set to “Enabled” and “Disable”.  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1407 to REG_DWORD = 3 (Disabled = 3).</fixtext>
      <fix id="F-23212r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowCutCopyPasteOperationsFromClipboardViaScript_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:35" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-6311">
    <title>DTBI136-User Authentication - Logon - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25641r1_rule" severity="medium" weight="10.0">
      <version>DTBI136</version>
      <title>The User Authentication – Logon is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Care must be taken with user credentials and how automatic logons are performed and how default Windows credentials are passed to web sites.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10651-8</ident>
      <fixtext fixref="F-23223r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Logon options" will be set to “Enabled” and "Anonymous logon".  Change the registry key HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1A00 to REG_DWORD = 196608 (decimal).</fixtext>
      <fix id="F-23223r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LogonOptions_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:36" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-7007">
    <title>DTBI121 - Java Permission - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25639r1_rule" severity="medium" weight="10.0">
      <version>DTBI121</version>
      <title>The Java Permissions is not set properly for the Restricted Sites Zone.</title>
      <description>&lt;VulnDiscussion&gt;Java must have a level of protection based upon the site being browsed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10620-3</ident>
      <fixtext fixref="F-23221r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java".  Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1C00 to REG_DWORD = 0 (Disabled = 0).</fixtext>
      <fix id="F-23221r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:37" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-14245">
    <title>DTBI697 - IE - Users enable or disable add-ons</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25817r1_rule" severity="low" weight="10.0">
      <version>DTBI697</version>
      <title>Internet Explorer - Do not allow users to enable or disable add-ons.</title>
      <description>&lt;VulnDiscussion&gt;This check verifies that the system is configured to allow users to enable or disable add-ons through Add-On Manager in Internet Explorer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-17008-4</ident>
      <fixtext fixref="F-23278r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer “Do Not Allow Users to enable or Disable Add-Ons” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria: Remove the value NoExtensionManagement or set to REG_DWORD = 0 (decimal).</fixtext>
      <fix id="F-23278r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DoNotAllowUsersEnableDisableAddOns_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:253" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15490">
    <title>DTBI305-Automatic configuration is not disabled</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25553r1_rule" severity="medium" weight="10.0">
      <version>DTBI305</version>
      <title>Automatic configuration of Internet Explorer is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This setting specifies to automatically detect the proxy server settings used to connect to the Internet and customize Internet Explorer. This setting specifies that Internet Explorer use the configuration settings provided in a file by the system administrator.  If you enable this policy setting, the user will not be able to do automatic configuration. You can import your current connection settings from your machine using Internet Explorer Maintenance under Admin Templates using group policy editor.  If you disable or do no configure this policy setting, the user will have the freedom to automatically configure these settings.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10638-5</ident>
      <fixtext fixref="F-23135r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; "Disable changing Automatic Configuration settings" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value Autoconfig to REG_DWORD = 1 (Hex).</fixtext>
      <fix id="F-23135r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DisableChangingAutomaticConfigurationSettings_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:38" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15492">
    <title>DTBI315 - Customer Experience Improvement Pgm</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-44917r1_rule" severity="medium" weight="10.0">
      <version>DTBI315</version>
      <title>Prevent participation in the Customer Experience Improvement Program is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This setting controls whether users can participate in the Microsoft Customer Experience Improvement Program to help improve Microsoft applications.
When users choose to participate in the Customer Experience Improvement Program (CEIP), applications automatically send information to Microsoft about how the applications are used. This information is combined with other CEIP data to help Microsoft solve problems and to improve the products and features customers use most often. This feature does not collect users' names, addresses, or any other identifying information except the IP address that is used to send the data.
By default, users have the opportunity to opt into participation in the CEIP the first time they run an application. If your organization has policies that govern the use of external resources such as the CEIP, allowing users to opt in to the program might cause them to violate these policies.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-38349r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer  -&gt; "Prevent participation in the Customer Experience Improvement Program" will be set to “Enabled”.

Procedure:  Use the Windows Registry Editor to navigate to the following key: 

HKLM\Software\Policies\Microsoft\Internet Explorer\SQM

Criteria: Set the value DisableCustomerImprovementProgram to REG_DWORD = 0.</fixtext>
      <fix id="F-38349r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.ie:def:410" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15494">
    <title>DTBI325 - Security settings check feature</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25560r1_rule" severity="medium" weight="10.0">
      <version>DTBI325</version>
      <title>Turn off the Security Settings Check feature is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.  If you enable this policy setting, the security settings check will not be performed.  If you disable or do not configure this policy setting, the security settings check will be performed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10607-0</ident>
      <fixtext fixref="F-23142r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; "Turn off the Security Settings Check feature" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Security Criteria: Set the value DisableSecuritySettingsCheck to REG_DWORD = 0.</fixtext>
      <fix id="F-23142r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffSecuritySettingsCheckFeature_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:3900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:39" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15497">
    <title>DTBI340 - Active content from CD's</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25561r1_rule" severity="medium" weight="10.0">
      <version>DTBI340</version>
      <title>Allow active content from CDs to run on user machines is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.  If you enable this policy setting, active content on a CD will run without a prompt.
If you disable this policy setting, active content on a CD will always prompt before running.  If you do not configure this policy, users can choose whether to be prompted before running active content on a CD.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10293-9</ident>
      <fixtext fixref="F-23143r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Advanced Page -&gt; "Allow active content from CDs to run on user machines" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Settings Criteria: Set the value LOCALMACHINE_CD_UNLOCK to REG_DWORD = 0.</fixtext>
      <fix id="F-23143r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowActiveContentFromCD_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:40" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15499">
    <title>DTBI350 - Software with invalid signatures</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25562r2_rule" severity="medium" weight="10.0">
      <version>DTBI350</version>
      <title>Allow software to run or install even if the signature is invalid is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;Microsoft ActiveX controls and file downloads often have digital signatures attached that vouch for both the file's integrity and the identity of the signer (creator) of the software.  An invalid signature might indicate that someone has tampered with the file.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10052-9</ident>
      <fixtext fixref="F-23144r2_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Advanced Page -&gt; "Allow software to run or install even if the signature is invalid" will be set to “Disabled”.</fixtext>
      <fix id="F-23144r2_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowSoftwareRunInstallSignatureInvalid_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:41" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15500">
    <title>DTBI355 - Third-party browser extensions</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25564r2_rule" severity="medium" weight="10.0">
      <version>DTBI355</version>
      <title>Allow third-party browser extensions are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether Internet Explorer will launch COM add-ons, known as browser helper objects such as toolbars. Browser helper objects may contain flaws such as buffer overruns which impact Internet Explorer's performance or stability.  If you enable this policy setting, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.  If you disable this policy setting, browser helper objects do not launch.  If you do not configure this policy, Internet Explorer automatically launches any browser helper objects that are installed on the user's computer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9905-1</ident>
      <fixtext fixref="F-23145r2_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Advanced Page -&gt; "Allow third-party browser extensions" will be set to “Disabled”.</fixtext>
      <fix id="F-23145r2_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowThird-PartyBrowserExtensions_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:42" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15502">
    <title>DTBI365 - Check for server certificate revocation</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25566r1_rule" severity="medium" weight="10.0">
      <version>DTBI365</version>
      <title>Check for server certificate revocation is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure. If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.  If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.  If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;IATS-1, IATS-2&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10074-3</ident>
      <fixtext fixref="F-23147r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Advanced Page -&gt; "Check for server certificate revocation" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Criteria: Set the value CertificateRevocation to REG_DWORD = 1.</fixtext>
      <fix id="F-23147r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="CheckServerCertificateRevocation_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:43" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15503">
    <title>DTBI370 - Signature checking - downloaded programs</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25567r1_rule" severity="medium" weight="10.0">
      <version>DTBI370</version>
      <title>Check for signatures on downloaded programs is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.  If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.
If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.  If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10055-2</ident>
      <fixtext fixref="F-23148r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Advanced Page -&gt; "Check for signatures on downloaded programs" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Download Criteria: Set the value CheckExeSignatures to REG_SZ = yes.</fixtext>
      <fix id="F-23148r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="CheckSignatureDownloadedPrograms_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:44" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15504">
    <title>DTBI375 - Network paths (UNC's) - Intranet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25568r1_rule" severity="medium" weight="10.0">
      <version>DTBI375</version>
      <title>Intranet Sites: Include all network paths (UNCs) are disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.  If you enable this policy setting, all network paths are mapped into the Intranet Zone.  If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).  If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9660-2</ident>
      <fixtext fixref="F-23149r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; "Intranet Sites: Include all network paths (UNCs)" will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Criteria: Set the value UNCAsIntranet to REG_DWORD = 0.</fixtext>
      <fix id="F-23149r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IncludeAllNetworkPaths_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:45" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15507">
    <title>DTBI385 - Script initiated windows - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25569r1_rule" severity="medium" weight="10.0">
      <version>DTBI385</version>
      <title>Allow script-initiated windows without size or position constraints for Internet Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.
If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.  If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.  If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9882-2</ident>
      <fixtext fixref="F-23150r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Allow script-initiated windows without size or position constraints" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2102 to REG_DWORD = 3.</fixtext>
      <fix id="F-23150r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:46" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15508">
    <title>DTBI390 - Script initiated windows - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25585r1_rule" severity="medium" weight="10.0">
      <version>DTBI390</version>
      <title>Allow script-initiated windows without size or position constraints for Restricted Sites Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.
If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.  If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.  If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9814-5</ident>
      <fixtext fixref="F-23167r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Allow script-initiated windows without size or position constraints" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2102 to REG_DWORD = 3.</fixtext>
      <fix id="F-23167r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowScriptInitiatedWindowsWithoutSizeOrPositionConstraints_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:47" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15509">
    <title>DTBI395 - Scriptlets - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25570r1_rule" severity="medium" weight="10.0">
      <version>DTBI395</version>
      <title>Allow Scriptlets are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether scriptlets can be allowed.
If you enable this policy setting, users will be able to run scriptlets.
If you disable this policy setting, users will not be able to run scriptlets.
If you do not configure this policy setting, a scriptlet can be enabled or disabled by the user.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10685-6</ident>
      <fixtext fixref="F-23151r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Allow Scriptlets" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1209 to REG_DWORD = 3.</fixtext>
      <fix id="F-23151r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowScriptlets_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:48" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15513">
    <title>DTBI415 - Prompt for file downloads - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25571r2_rule" severity="medium" weight="10.0">
      <version>DTBI415</version>
      <title>Automatic prompting for file downloads is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.  If you enable this setting, users will receive a file download dialog for automatic download attempts.
If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10389-5</ident>
      <fixtext fixref="F-23152r5_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Automatic prompting for file downloads" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2200 to REG_DWORD = 3.</fixtext>
      <fix id="F-23152r5_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AutomaticPromptingFileDownloads_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:4900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:49" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15515">
    <title>DTBI425 - Java permission - Local Machine</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25578r2_rule" severity="medium" weight="10.0">
      <version>DTBI425</version>
      <title>Java permissions for my computer are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage permissions for Java applets.
If you enable this policy setting, you can choose options from the drop-down box.  Low Safety enables applets to perform all operations.  Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.   High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.
If you disable this policy setting, Java applets cannot run.  If you do not configure this policy setting, the permission is set to High Safety.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10319-2</ident>
      <fixtext fixref="F-23159r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Local Machine Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Criteria: Set the value 1C00 to REG_DWORD = 0.</fixtext>
      <fix id="F-23159r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_LocalMachineZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:50" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15516">
    <title>DTBI430 - Java permission - Locked Down Machine</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25581r2_rule" severity="medium" weight="10.0">
      <version>DTBI430</version>
      <title>Java permissions for my computer group policy are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage permissions for Java applets.
If you enable this policy setting, you can choose options from the drop-down box.  Low Safety enables applets to perform all operations.  Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.   High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.
If you disable this policy setting, Java applets cannot run.  If you do not configure this policy setting, the permission is set to High Safety.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10535-3</ident>
      <fixtext fixref="F-23162r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Locked-Down Local Machine Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 Criteria: Set the value 1C00 to REG_DWORD = 0.</fixtext>
      <fix id="F-23162r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_LockedDownLocalMachineZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:51" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15517">
    <title>DTBI435 - Java permission - Locked Down Intranet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25580r2_rule" severity="medium" weight="10.0">
      <version>DTBI435</version>
      <title>Java permissions for group policy for Local Intranet Zone are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage permissions for Java applets.
If you enable this policy setting, you can choose options from the drop-down box. Low Safety enables applets to perform all operations.  Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.   High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.
If you disable this policy setting, Java applets cannot run.  If you do not configure this policy setting, the permission is set to High Safety.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10342-4</ident>
      <fixtext fixref="F-23161r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Locked-Down Intranet Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 Criteria: Set the value 1C00 to REG_DWORD = 0.</fixtext>
      <fix id="F-23161r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_LockedDownIntranetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:52" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15518">
    <title>DTBI440 - Java permission - Locked Down Trusted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25583r2_rule" severity="medium" weight="10.0">
      <version>DTBI440</version>
      <title>Java permissions for group policy for Trusted Sites Zone are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage permissions for Java applets.
If you enable this policy setting, you can choose options from the drop-down box.  Low Safety enables applets to perform all operations.  Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.   High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.
If you disable this policy setting, Java applets cannot run.  If you do not configure this policy setting, the permission is set to High Safety.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10654-2</ident>
      <fixtext fixref="F-23165r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Locked-Down Trusted Sites Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 Criteria: Set the value 1C00 to REG_DWORD = 0.</fixtext>
      <fix id="F-23165r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_LockedDownTrustedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:53" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15519">
    <title>DTBI445 - Java permission - Locked Down Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25579r2_rule" severity="medium" weight="10.0">
      <version>DTBI445</version>
      <title>Java permissions for group policy for Internet Zone are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage permissions for Java applets.
If you enable this policy setting, you can choose options from the drop-down box. Low Safety enables applets to perform all operations.  Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.   High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.
If you disable this policy setting, Java applets cannot run.  If you do not configure this policy setting, the permission is set to High Safety.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10597-3</ident>
      <fixtext fixref="F-23160r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Locked-Down Internet Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 Criteria: Set the value 1C00 to REG_DWORD = 0.</fixtext>
      <fix id="F-23160r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_LockedDownInternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:54" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15520">
    <title>DTBI450 - Java permission - Locked Down Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25582r2_rule" severity="medium" weight="10.0">
      <version>DTBI450</version>
      <title>Java permissions for group policy for Restricted Sites Zone are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage permissions for Java applets.
If you enable this policy setting, you can choose options from the drop-down box. Low Safety enables applets to perform all operations.  Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.   High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.
If you disable this policy setting, Java applets cannot run.  If you do not configure this policy setting, the permission is set to High Safety.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCMC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10275-6</ident>
      <fixtext fixref="F-23163r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Locked-Down Restricted Sites Zone -&gt; "Java permissions" will be set to “Enabled” and "Disable Java" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following keys: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 Criteria: Set the value 1C00 to REG_DWORD = 0.</fixtext>
      <fix id="F-23163r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="JavaPermissions_LockedDownRestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:55" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15521">
    <title>DTBI455 - Loose XAML files - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25572r1_rule" severity="medium" weight="10.0">
      <version>DTBI455</version>
      <title>Loose XAML files for Internet Zone are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.  If you enable this policy setting and the dropdown box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading XAML files.  If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior.  If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10672-4</ident>
      <fixtext fixref="F-23153r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Loose XAML files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2402 to REG_DWORD = 3.</fixtext>
      <fix id="F-23153r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LooseXAMLFiles_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:56" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15522">
    <title>DTBI460 - Loose XAML files - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25587r1_rule" severity="medium" weight="10.0">
      <version>DTBI460</version>
      <title>Loose XAML files for Restricted Sites Zone are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;These are eXtensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that leverage the Windows Presentation Foundation.  If you enable this policy setting and the dropdown box is set to Enable, XAML files will be automatically loaded inside Internet Explorer. Users will not be able to change this behavior. If the dropdown box is set to Prompt, users will receive a prompt for loading XAML files.  If you disable this policy setting, XAML files will not be loaded inside Internet Explorer. Users will not be able to change this behavior.  If you do not configure this policy setting, users will have the freedom to decide whether to load XAML files inside Internet Explorer.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10178-2</ident>
      <fixtext fixref="F-23169r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Loose XAML files" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2402 to REG_DWORD = 3.</fixtext>
      <fix id="F-23169r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LooseXAMLFiles_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:57" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15523">
    <title>DTBI465 - MIME sniffing - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25573r1_rule" severity="medium" weight="10.0">
      <version>DTBI465</version>
      <title>Open files based on content, not file extension for Internet Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.  If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.  If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.
If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10107-1</ident>
      <fixtext fixref="F-23154r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Open files based on content, not file extension" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2100 to REG_DWORD = 3.</fixtext>
      <fix id="F-23154r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="OpenFilesBasedOnContent_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:58" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15524">
    <title>DTBI470 - MIME sniffing - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25588r1_rule" severity="medium" weight="10.0">
      <version>DTBI470</version>
      <title>Open files based on content, not file extension for Restricted Sites Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.  If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.  If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.
If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10277-2</ident>
      <fixtext fixref="F-23170r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Open files based on content, not file extension" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2100 to REG_DWORD = 3.</fixtext>
      <fix id="F-23170r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="OpenFilesBasedOnContent_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:5900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:59" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15525">
    <title>DTBI475 - First-Run Opt-In - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25574r1_rule" severity="medium" weight="10.0">
      <version>DTBI475</version>
      <title>Turn Off First-Run Opt-In for Internet Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls the First Run response that users see on a zone-by-zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.  
If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.  If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.   If you do not configure this policy setting, the first-run prompt is turned off by default.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10434-9</ident>
      <fixtext fixref="F-23155r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Turn Off First-Run Opt-In" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1208 to REG_DWORD = 0.</fixtext>
      <fix id="F-23155r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffFirstRunOptIn_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:60" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15526">
    <title>DTBI480 - First-Run Opt-In - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25592r1_rule" severity="medium" weight="10.0">
      <version>DTBI480</version>
      <title>Turn Off First-Run Opt-In for Restricted Sites Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls the First Run response that users see on a zone-by-zone basis.  When a user encounters a new control that has not previously run in Internet Explorer, they may be prompted to approve the control.  This feature determines if the user gets the prompt or not.  
If you enable this policy setting, the Gold Bar prompt will be turned off in the corresponding zone.  If you disable this policy setting, the Gold Bar prompt will be turned on in the corresponding zone.   If you do not configure this policy setting, the first-run prompt is turned off by default.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10420-8</ident>
      <fixtext fixref="F-23174r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Turn Off First-Run Opt-In" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1208 to REG_DWORD = 0.</fixtext>
      <fix id="F-23174r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffFirstRunOptIn_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:61" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15527">
    <title>Internet Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25575r1_rule" severity="medium" weight="10.0">
      <version>DTBI485</version>
      <title>Turn on Protected Mode Internet Zone is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.  If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode.  If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.  If you do not configure this policy, users will be able to turn on or off protected mode.
Requires Windows Vista; will be ignored by Windows XP.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10676-5</ident>
      <fixtext fixref="F-23156r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Turn on Protected Mode" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2500 to REG_DWORD = 0.</fixtext>
      <fix id="F-23156r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOnProtectedMode_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:62" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15528">
    <title>DTBI490 - Protected Mode - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25593r1_rule" severity="medium" weight="10.0">
      <version>DTBI490</version>
      <title>Turn on Protected Mode for Restricted Sites Zone is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;VISTA Only
Protected mode protects Internet Explorer from exploited vulnerabilities by reducing the locations Internet Explorer can write to in the registry and the file system.  If you enable this policy setting, Protected Mode will be turned on. Users will not be able to turn off protected mode.  If you disable this policy setting, Protected Mode will be turned off. It will revert to Internet Explorer 6 behavior that allows for Internet Explorer to write to the registry and the file system. Users will not be able to turn on protected mode.  If you do not configure this policy, users will be able to turn on or off protected mode.
Requires Windows Vista; will be ignored by Windows XP.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9945-7</ident>
      <fixtext fixref="F-23175r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Turn on Protected Mode" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2500 to REG_DWORD = 0.</fixtext>
      <fix id="F-23175r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOnProtectedMode_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:63" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15529">
    <title>DTBI495 - Pop-up Blocker - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25576r1_rule" severity="medium" weight="10.0">
      <version>DTBI495</version>
      <title>Use Pop-up Blocker for Internet Zone is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.  If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.  If you disable this policy setting, pop-up windows are not prevented from appearing.  If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10486-9</ident>
      <fixtext fixref="F-23157r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Use Pop-up Blocker" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1809 to REG_DWORD = 0.</fixtext>
      <fix id="F-23157r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="UsePop-upBlocker_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:64" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15530">
    <title>DTBI500 - Pop-up Blocker - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25594r1_rule" severity="medium" weight="10.0">
      <version>DTBI500</version>
      <title>Use Pop-up Blocker for Restricted Sites Zone is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.  If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.  If you disable this policy setting, pop-up windows are not prevented from appearing.  If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10094-1</ident>
      <fixtext fixref="F-23176r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Use Pop-up Blocker" will be set to “Enabled” and "Enable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1809 to REG_DWORD = 0.</fixtext>
      <fix id="F-23176r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="UsePop-upBlocker_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:65" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15533">
    <title>DTBI515 - Less privileged web content - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25577r1_rule" severity="medium" weight="10.0">
      <version>DTBI515</version>
      <title>Web sites in less privileged Web content zones can navigate into Internet Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.  If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.  If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10622-9</ident>
      <fixtext fixref="F-23158r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; "Web sites in less privileged Web content zones can navigate into this zone" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria:Set the value 2101 to REG_DWORD = 3.</fixtext>
      <fix id="F-23158r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:66" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15534">
    <title>DTBI520 - Less privileged web content - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25595r1_rule" severity="medium" weight="10.0">
      <version>DTBI520</version>
      <title>Web sites in less privileged Web content zones can navigate into Restricted Sites Zone is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.
If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.  The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.  If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.  If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10609-6</ident>
      <fixtext fixref="F-23177r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Web sites in less privileged Web content zones can navigate into this zone" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2101 to REG_DWORD = 3.</fixtext>
      <fix id="F-23177r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="WebSitesInLessPrivilegedWebContentZonesCanNavigateIntoThisZone_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:67" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15545">
    <title>DTBI575 - Binary and script behaviors - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25584r1_rule" severity="medium" weight="10.0">
      <version>DTBI575</version>
      <title>Allow binary and script behaviors are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage dynamic binary and script behaviors; components that encapsulate specific functionality for HTML elements to which they were attached.  If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available. If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.  If you do not configure this policy setting, binary and script behaviors are available.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10547-8</ident>
      <fixtext fixref="F-23166r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Allow binary and script behaviors" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2000 to REG_DWORD = 3.</fixtext>
      <fix id="F-23166r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowBinaryAndScriptBehaviors_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:68" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15546">
    <title>DTBI580 - Prompt for file downloads - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25586r2_rule" severity="medium" weight="10.0">
      <version>DTBI580</version>
      <title>Automatic prompting for file downloads is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.  If you enable this setting, users will receive a file download dialog for automatic download attempts.  If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9959-8</ident>
      <fixtext fixref="F-23168r3_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Automatic prompting for file downloads" will be set to “Enabled” and "Disable" selected from down drop box. 

Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 

Criteria: Set the value 2200 to REG_DWORD = 3.</fixtext>
      <fix id="F-23168r3_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AutomaticPromptingFileDownloads_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:233" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15548">
    <title>DTBI590 - MIME handling - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25598r1_rule" severity="medium" weight="10.0">
      <version>DTBI590</version>
      <title>Internet Explorer Processes for MIME handling is not enabled. (Reserved)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted.  If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file.  MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network.  This guide recommends you configure this policy as Enabled for all environments specified in this guide.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23180r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Consistent Mime Handling -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-23180r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorerMimeHandling_FeatureControl_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:234" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15549">
    <title>DTBI595 - MIME sniffing - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25601r1_rule" severity="medium" weight="10.0">
      <version>DTBI595</version>
      <title>Internet Explorer Processes for MIME sniffing is not enabled. (Reserved)</title>
      <description>&lt;VulnDiscussion&gt;MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed.  MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network.  This guide recommends you configure this policy as Enabled for all environments specified in this guide.  Note: This setting works in conjunction with, but does not replace, the Consistent MIME Handling settings.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23183r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Mime Sniffing Safety Feature -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-23183r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorerMimeSniffing_InternetExplorerProcesses_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:237" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15550">
    <title>DTBI600 - MK Protocol - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25648r1_rule" severity="medium" weight="10.0">
      <version>DTBI600</version>
      <title>Internet Explorer Processes for MK protocol is not enabled. (Explorer)</title>
      <description>&lt;VulnDiscussion&gt;The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Setting this policy to Enabled blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API.  Because the MK protocol is not widely used, it should be blocked wherever it is not needed.  This guide recommends you configure this setting to Enabled to block the MK protocol unless it is specifically needed in your environment.  Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23230r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; MK Protocol Security Restriction -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23230r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorerMkProtocol_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:241" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15551">
    <title>DTBI605 - MK Protocol - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25605r1_rule" severity="medium" weight="10.0">
      <version>DTBI605</version>
      <title>Internet Explorer Processes for MK protocol is not enabled. (IExplore)</title>
      <description>&lt;VulnDiscussion&gt;The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Setting this policy to Enabled blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API.  Because the MK protocol is not widely used, it should be blocked wherever it is not needed.  This guide recommends you configure this setting to Enabled to block the MK protocol unless it is specifically needed in your environment.  Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23187r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; MK Protocol Security Restriction -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23187r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorerMkProtocol_Iexplore_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:242" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15552">
    <title>DTBI610 - Zone elevation - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25649r1_rule" severity="medium" weight="10.0">
      <version>DTBI610</version>
      <title>Internet Explorer Processes for Zone Elevation is not enabled. (Reserved)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers.  If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23231r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Protection From Zone Elevation -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-23231r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorer_ZoneElevation_Reserved_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:243" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15556">
    <title>DTBI630 - File download processes - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25653r1_rule" severity="medium" weight="10.0">
      <version>DTBI630</version>
      <title>Internet Explorer Processes for Download prompt is not enabled.  (Reserved)</title>
      <description>&lt;VulnDiscussion&gt;In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download.  If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes.  Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23235r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Restrict File Download -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-23235r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorer_DownloadPrompt_RestrictFileDownload_Reserved_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:246" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15557">
    <title>DTBI635 - File download processes - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25654r1_rule" severity="medium" weight="10.0">
      <version>DTBI635</version>
      <title>Internet Explorer Processes for Download prompt is not enabled.  (Explorer)</title>
      <description>&lt;VulnDiscussion&gt;In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download.  If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes.  Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23236r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Restrict File Download -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23236r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorer_DownloadPrompt_RestrictFileDownload_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:247" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15558">
    <title>DTBI640 - File download processes - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25655r1_rule" severity="medium" weight="10.0">
      <version>DTBI640</version>
      <title>Internet Explorer Processes for Download prompt is not enabled.  (IExplore)</title>
      <description>&lt;VulnDiscussion&gt;In certain circumstances, Web sites can initiate file download prompts without interaction from users. This technique can allow Web sites to put unauthorized files on users' hard drives if they click the wrong button and accept the download.  If you configure the Restrict File Download\Internet Explorer Processes policy setting to Enabled, file download prompts that are not user-initiated are blocked for Internet Explorer processes. If you configure this policy setting as Disabled, prompting will occur for file downloads that are not user-initiated for Internet Explorer processes.  Note: This setting is configured as Enabled in all environments specified in this guide to help prevent attackers from placing arbitrary code on users' computers.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23237r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Restrict File Download -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23237r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorer_DownloadPrompt_RestrictFileDownload_Iexplorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:248" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15559">
    <title>DTBI645 - Restricting Pop Up Windows - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25659r1_rule" severity="medium" weight="10.0">
      <version>DTBI645</version>
      <title>Internet Explorer Processes for restricting pop-up windows is not enabled. (Reserved)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code.  The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows’ title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows.  Recommend configuring this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23239r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Scripted Window Security Restrictions -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: Set the value (Reserved) is REG_SZ = 1.</fixtext>
      <fix id="F-23239r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="InternetExplorer_PopUpRestricting_Reserved_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:249" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15560">
    <title>DTBI650 - .NET w/Authenticode unsigned-Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25589r2_rule" severity="medium" weight="10.0">
      <version>DTBI650</version>
      <title>Run .NET Framework-reliant components not signed with Authenticode are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.  If you disable this policy setting, Internet Explorer will not execute unsigned managed components.  If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9898-8</ident>
      <fixtext fixref="F-23171r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Run .NET Framework-reliant components not signed with Authenticode" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2004 to REG_DWORD = 3.</fixtext>
      <fix id="F-23171r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:6900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:69" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15561">
    <title>DTBI655 - .NET w/Authenticode signed - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25590r1_rule" severity="medium" weight="10.0">
      <version>DTBI655</version>
      <title>Run .NET Framework-reliant components signed with Authenticode are not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.
If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.  If you disable this policy setting, Internet Explorer will not execute unsigned managed components.  If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9673-5</ident>
      <fixtext fixref="F-23172r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Run .NET Framework-reliant components signed with Authenticode" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2001 to REG_DWORD = 3.</fixtext>
      <fix id="F-23172r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="RunNETFrameworkReliantComponentsSignedWithAuthenticode_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:70" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15562">
    <title>DTBI670 - Scripting of Java applets - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25591r2_rule" severity="medium" weight="10.0">
      <version>DTBI670</version>
      <title>Scripting of Java applets is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether applets are exposed to scripts within the zone.  If you enable this policy setting, scripts can access applets automatically without user intervention.  If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.  If you disable this policy setting, scripts are prevented from accessing applets.  If you do not configure this policy setting, scripts can access applets automatically without user intervention.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10083-4</ident>
      <fixtext fixref="F-23173r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; "Scripting of Java applets" will be set to “Enabled” and "Disable" selected from down drop box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1402 to REG_DWORD = 3.</fixtext>
      <fix id="F-23173r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="ScriptingOfJavaApplets_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:71" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15563">
    <title>DTBI675 - Displaying URL's for update checking</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25596r1_rule" severity="medium" weight="10.0">
      <version>DTBI675</version>
      <title>Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows checking for updates for Internet Explorer from the specified URL, included by default in Internet Explorer.  If you enable this policy setting, users will not be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools. You must specify the URL to be displayed for checking updates to Internet Explorer and Internet Tools.  If you disable or do not configure this policy setting, users will be able to change the URL to be displayed for checking updates to Internet Explorer and Internet Tools.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10595-7</ident>
      <fixtext fixref="F-23178r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Settings -&gt; Component Updates -&gt; Periodic check for updates to Internet Explorer and Internet Tools -&gt; "Turn off changing the URL to be displayed for checking updates to Internet Explorer and Internet Tools" will be set to “Enabled” and "blank or empty" selection box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Create the value Update_Check_Page. The value must contain no data.</fixtext>
      <fix id="F-23178r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffChangingURLDisplay_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:252" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15564">
    <title>DTBI680 - Update check interval</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25597r1_rule" severity="medium" weight="10.0">
      <version>DTBI680</version>
      <title>Turn off configuring the update check interval is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This setting specifies the update check interval. The default value is 30 days.
If you enable this policy setting, the user will not be able to configure the update check interval. You have to specify the update check interval.
If you disable or do not configure this policy setting, the user will have the freedom to configure the update check interval.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9776-6</ident>
      <fixtext fixref="F-23179r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Settings -&gt; Component Updates -&gt; Periodic check for updates to Internet Explorer and Internet Tools -&gt; "Turn off configuring the update check interval (in days)" will be set to “Enabled” and "30" selected from drop down box. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value Update_Check_Interval to REG_DWORD = 30 (Decimal).</fixtext>
      <fix id="F-23179r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffConfiguringUpdateCheckInterval_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:72" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15565">
    <title>DTBI592 - MIME handling - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25599r1_rule" severity="medium" weight="10.0">
      <version>DTBI592</version>
      <title>Internet Explorer Processes for MIME handling is not enabled.  (Explorer)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted.  If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file.  MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23181r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Consistent Mime Handling -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23181r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_MimeHandling_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:235" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15566">
    <title>DTBI594 - MIME handling - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25600r1_rule" severity="medium" weight="10.0">
      <version>DTBI594</version>
      <title>Internet Explorer Processes for MIME handling is not enabled. (IExplore)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server. The Consistent MIME Handling\Internet Explorer Processes policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME data indicates that the file is really an executable file, Internet Explorer changes its extension to reflect this executable status. This capability helps ensure that executable code cannot masquerade as other types of data that may be trusted.  If you enable this policy setting, Internet Explorer examines all received files and enforces consistent MIME data for them. If you disable or do not configure this policy setting, Internet Explorer does not require consistent MIME data for all received files and will use the MIME data provided by the file.  MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistent and properly labeled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23182r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Consistent Mime Handling -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23182r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_MimeHandling_Iexplorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:236" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15568">
    <title>DTBI599 - MK Protocol - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25604r1_rule" severity="medium" weight="10.0">
      <version>DTBI599</version>
      <title>Internet Explorer Processes for MK protocol is not enabled.  (Reserved)</title>
      <description>&lt;VulnDiscussion&gt;The MK Protocol Security Restriction policy setting reduces attack surface area by blocking the seldom used MK protocol. Some older Web applications use the MK protocol to retrieve information from compressed files. Setting this policy to Enabled blocks the MK protocol for Windows Explorer and Internet Explorer, which causes resources that use the MK protocol to fail. Disabling this setting allows applications to use the MK protocol API.  Because the MK protocol is not widely used, it should be blocked wherever it is not needed. This guide recommends you configure this setting to Enabled to block the MK protocol unless you specifically need it in your environment. Note: Because resources that use the MK protocol will fail when you deploy this setting, you should ensure that none of your applications use the MK protocol.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10265-7</ident>
      <fixtext fixref="F-23186r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; MK Protocol Security Restriction -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-23186r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_MkProtocol_Reserved_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:240" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15569">
    <title>DTBI612 - Zone Elevation - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25650r1_rule" severity="medium" weight="10.0">
      <version>DTBI612</version>
      <title>Internet Explorer Processes for Zone Elevation is not enabled. (Explorer)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers.  If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23232r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Protection From Zone Elevation -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23232r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_ZoneElevation_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:244" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15570">
    <title>DTBI614 - Zone elevation - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25651r1_rule" severity="medium" weight="10.0">
      <version>DTBI614</version>
      <title>Internet Explorer Processes for Zone Elevation is not enabled. (IExplore)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer places restrictions on each Web page it opens that are dependent upon the location of the Web page (such as Internet Zone, Intranet Zone, or Local Machine Zone). Web pages on a local computer have the fewest security restrictions and reside in the Local Machine Zone, which makes the Local Machine Security Zone a prime target for malicious attackers.  If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes. This approach stops content running in one zone from gaining the elevated privileges of another zone. If you disable this policy setting, no zone receives such protection for Internet Explorer processes. Because of the severity and relative frequency of zone elevation attacks, this guide recommends that you configure this setting as Enabled in all environments.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23233r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Protection From Zone Elevation -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23233r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_ZoneElevation_Iexplorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:24500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:245" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15571">
    <title>DTBI647 - Internet Explorer Processes for restrict</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25661r1_rule" severity="medium" weight="10.0">
      <version>DTBI647</version>
      <title>Internet Explorer Processes for restricting pop-up windows is not enabled.  (Explorer)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code.  The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows’ title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows.  This guide recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23241r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Scripted Window Security Restrictions -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23241r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_PopUpRestricting_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:250" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15572">
    <title>DTBI649 - Restricting Pop Up windows - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25663r1_rule" severity="medium" weight="10.0">
      <version>DTBI649</version>
      <title>Internet Explorer Processes for restricting pop-up windows is not enabled.  (IExplorer)</title>
      <description>&lt;VulnDiscussion&gt;Internet Explorer allows scripts to programmatically open, resize, and reposition various types of windows. Often, disreputable Web sites will resize windows to either hide other windows or force you to interact with a window that contains malicious code.  The Scripted Window Security Restrictions security feature restricts pop-up windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or hide other windows’ title and status bars. If you enable the Scripted Window Security Restrictions\Internet Explorer Processes policy setting, pop-up windows and other restrictions apply for Windows Explorer and Internet Explorer processes. If you disable or do not configure this policy setting, scripts can continue to create pop-up windows and windows that hide other windows.  This guide recommends you configure this setting to Enabled to help prevent malicious Web sites from controlling your Internet Explorer windows or fooling users into clicking on the wrong window.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23242r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Scripted Window Security Restrictions -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23242r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_PopUpRestricting_Iexplorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:251" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15579">
    <title>DTBI715 - Crash Detection</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25558r1_rule" severity="medium" weight="10.0">
      <version>DTBI715</version>
      <title>Turn off Crash Detection is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;The Turn off Crash Detection policy setting allows you to manage the crash detection feature of add-on management in Internet Explorer. If you enable this policy setting, a crash in Internet Explorer will be similar to one on a computer running Windows XP Professional Service Pack 1 and earlier: Windows Error Reporting will be invoked. If you disable this policy setting, the crash detection feature in add-on management will be functional.  Because Internet Explorer crash report information could contain sensitive information from the computer's memory, this guide recommends you configure this option to Enabled unless you are experiencing frequent repeated crashes and need to report them for follow-up troubleshooting. In those cases, you could temporarily configure the setting to Disabled.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10594-0</ident>
      <fixtext fixref="F-23140r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; "Turn off Crash Detection" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions Criteria:Set the value NoCrashDetection to REG_DWORD = 1.</fixtext>
      <fix id="F-23140r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffCrashDetection_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:73" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15603">
    <title>DTBI596 - MIME sniffing - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25602r1_rule" severity="medium" weight="10.0">
      <version>DTBI596</version>
      <title>Internet Explorer Processes for MIME sniffing is not enabled.  (Explorer)</title>
      <description>&lt;VulnDiscussion&gt;MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed.  MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23184r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Mime Sniffing Safety Feature -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23184r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_MimeSniffing_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:238" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-15604">
    <title>DTBI597 - MIME sniffing - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25603r1_rule" severity="medium" weight="10.0">
      <version>DTBI597</version>
      <title>Internet Explorer Processes for MIME sniffing is not enabled.  (IExplore)</title>
      <description>&lt;VulnDiscussion&gt;MIME sniffing is the process of examining the content of a MIME file to determine its context — whether it is a data file, an executable file, or some other type of file. This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type. When set to Enabled, MIME sniffing will never promote a file of one type to a more dangerous file type. Disabling MIME sniffing configures Internet Explorer processes to allow a MIME sniff that promotes a file of one type to a more dangerous file type. For example, promoting a text file to an executable file is a dangerous promotion because any code in the supposed text file would be executed.  MIME file-type spoofing is a potential threat to your organization. Ensuring that these files are consistently handled helps prevent malicious file downloads from infecting your network. This guide recommends you configure this policy as Enabled for all environments specified in this guide. Note: This setting works in conjunction with, but does not replace, the Consistent MIME handling settings.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23185r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Mime Sniffing Safety Feature -&gt; "Internet Explorer Processes" will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_SNIFFING Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-23185r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcesses_MimeSniffing_Iexplorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:239" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-17296">
    <title>Prevent performance of First Run Customize setting</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25825r1_rule" severity="medium" weight="10.0">
      <version>DTBI010</version>
      <title>Prevent performance of First Run Customize settings is not enabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting prevents performance of the First Run Customize settings ability and controls what the user will see when they launch Internet Explorer for the first time after installation of Internet Explorer.
If you enable this policy setting, users must make one of two choices:
1) Skip Customize Settings, and go directly to the user’s home page, or
2:) Skip Customize Settings, and go directly to the "Welcome to Internet Explorer" Web page.
If you disable or do not configure this policy setting, users go through the regular first run process.
&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10641-9</ident>
      <fixtext fixref="F-23139r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; "Prevent performance of First Run Customize settings" will be set to “Enabled” and "Go directly to home page" selected. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main Criteria: Set the value DisableFirstRunCustomize to REG_DWORD = 1.</fixtext>
      <fix id="F-23139r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="PreventPerformanceOfFirstRunCustomizeSettings_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:75" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-21887">
    <title>DTBI300 - Configuring History lists</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25652r1_rule" severity="medium" weight="10.0">
      <version>DTBI300</version>
      <title>Disable Configuring History - History setting is not set to 40 days.</title>
      <description>&lt;VulnDiscussion&gt;This setting specifies the number of days that Internet Explorer keeps track of the pages viewed in the History List. The delete Browsing History option can be accessed using Tools, Internet Options, General tab, and then click Settings under Browsing History.  If you enable this policy setting, a user cannot set the number of days that Internet Explorer keeps track of the pages viewed in the History List. You must specify the number of days that Internet Explorer keeps track of the pages viewed in the History List. Users will not be able to delete browsing history.  If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History List.  Users can delete browsing history.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10387-9</ident>
      <fixtext fixref="F-23234r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Delete Browsing History -&gt; "Disable "Configuring History" " will be set to “Enabled” and "40" entered in 'Days to keep pages in History'. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel Criteria: Set the value History to REG_DWORD = 1 and HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Url History Criteria: Set the value DaysToKeep to REG_DWORD = 40 (decimal).</fixtext>
      <fix id="F-23234r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="DisableConfigHistorySetting_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:23200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:232" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22108">
    <title>DTBI740 - Managing SmartScreen Filter</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25697r1_rule" severity="medium" weight="10.0">
      <version>DTBI740</version>
      <title>Turn off Managing SmartScreen Filter property is not properly set.</title>
      <description>&lt;VulnDiscussion&gt;This setting allows users to enable the SmartScreen Filter, which then warns if a Web site being visited is known for fraudulent attempts to gather personal information through "phishing" or is known to host malware.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9973-9</ident>
      <fixtext fixref="F-23253r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; “Turn off Managing SmartScreen Filter” will be set to “Enabled” and “Off”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\PhishingFilter Criteria: Set the value EnabledV8 to REG_DWORD = 0.</fixtext>
      <fix id="F-23253r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnoffManagingSmartScreenFilter_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:76" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22147">
    <title>DTBI750 - Microsoft web site list updates</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25699r2_rule" severity="low" weight="10.0">
      <version>DTBI750</version>
      <title>Include updated Web site lists from Microsoft is disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy controls the Web site compatibility lists provided by Microsoft.  If you do not configure this setting, the Microsoft Web site list will not be active.  The user can enable the functionality using the Compatibility View Settings dialog box.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;May adversely impact system.&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10603-9</ident>
      <fixtext fixref="F-23254r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Compatibility View -&gt; “Include updated Web site lists from Microsoft” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation Criteria: Set the value MSCompatibilityMode to REG_DWORD = 0.</fixtext>
      <fix id="F-23254r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IncludeUpdatedWebsiteListsFromMicrosoft_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:77" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22148">
    <title>DTBI760 - Browsing History on exit</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25701r1_rule" severity="medium" weight="10.0">
      <version>DTBI760</version>
      <title>Delete Browsing History on exit is disabled.</title>
      <description>&lt;VulnDiscussion&gt;Delete Browsing History on exit automatically deletes specified items when the last browser window closes.  Disabling this function will prevent users from deleting their browsing history, which could be used to identify malicious Web sites and files that could later be used for anti-virus and intrusion detection system (IDS) signatures.  Furthermore, preventing users from deleting browsing history could be used to identify abusive web surfing on government systems.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10590-8</ident>
      <fixtext fixref="F-23255r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Delete Browsing History -&gt; “Configure Delete Browsing History on exit” will be set to “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: Set the value ClearBrowsingHistoryOnExit to REG_DWORD = 0.</fixtext>
      <fix id="F-23255r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="ConfigureDeleteBrowsingHistoryonexit_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:78" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22149">
    <title>DTBI770 - Web site visit history</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25703r1_rule" severity="medium" weight="10.0">
      <version>DTBI770</version>
      <title>Prevent Deleting Web sites that the User has Visited is enabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy prevents users from deleting the history of Web sites the user has visited.  If you do not configure this policy setting, the user will be able to select whether to delete or preserve Web sites the user visited when the user clicks Delete.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10110-5</ident>
      <fixtext fixref="F-23256r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Delete Browsing History -&gt; “Prevent Deleting Web sites that the User has Visited” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: Set the value CleanHistory to REG_DWORD = 0.</fixtext>
      <fix id="F-23256r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="PreventDeletingWebsitesthattheUserhasVisited_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:7900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:79" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22150">
    <title>DTBI780 - InPrivate Browsing</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25705r1_rule" severity="medium" weight="10.0">
      <version>DTBI780</version>
      <title>Turn off InPrivate Browsing is enabled.</title>
      <description>&lt;VulnDiscussion&gt;InPrivate Browsing lets you control whether or not Internet Explorer 8 saves your browsing history, cookies, and other data.  The InPrivate Browsing feature in Internet Explorer 8 makes browser privacy easy by not storing history, cookies, temporary Internet files, or other data.  If you do not configure this setting, InPrivate Browsing can be turned on or off through the registry.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9885-5</ident>
      <fixtext fixref="F-23257r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; InPrivate -&gt; “Turn off InPrivate Browsing” will be set to “Enabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Privacy Criteria: Set the value EnableInPrivateBrowsing to REG_DWORD = 0.</fixtext>
      <fix id="F-23257r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnOffInPrivateBrowsing_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:80" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22152">
    <title>DTBI800 - Browser scripting control - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25709r1_rule" severity="medium" weight="10.0">
      <version>DTBI800</version>
      <title>Allow scripting of Internet Explorer web browser control property is set (Internet Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether a page may control embedded WebBrowser Controls via script.  If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user.  By default, script access to the WebBrowser control is only allowed in the Local Machine and Intranet Zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9779-0</ident>
      <fixtext fixref="F-23259r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; “Allow scripting of Internet Explorer web browser control” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1206 to REG_DWORD = 3.</fixtext>
      <fix id="F-23259r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowScriptingOfInternetExplorerWebBrowserControl_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:81" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22153">
    <title>DTBI810 - Local directory paths - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25711r1_rule" severity="medium" weight="10.0">
      <version>DTBI810</version>
      <title>Include local directory path when uploading files to a server property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form.  By default, path information will be sent.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10646-8</ident>
      <fixtext fixref="F-23260r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; “Include local directory path when uploading files to a server” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 160A to REG_DWORD = 3.</fixtext>
      <fix id="F-23260r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IncludeLocalDirectoryPathWhenUploadingFilesToAServer_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:82" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22154">
    <title>DTBI820 - Programs and unsafe files - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25713r1_rule" severity="medium" weight="10.0">
      <version>DTBI820</version>
      <title>Launching programs and unsafe files property is properly set (Internet Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether or not the “Open File – Security Warning” prompt is shown when launching executables or other unsafe files.  If you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer Zone, and set to prompt in the Internet and Trusted Zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10650-0</ident>
      <fixtext fixref="F-23261r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; “Launching programs and unsafe files” will be set to “Enabled” and “Prompt”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1806 to REG_DWORD = 1.</fixtext>
      <fix id="F-23261r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LaunchingProgramsAndUnsafeFiles_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8300" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:83" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22155">
    <title>DTBI830 - ActiveX controls no prompt - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25715r1_rule" severity="medium" weight="10.0">
      <version>DTBI830</version>
      <title>Only allow approved domains to use ActiveX controls without prompt property is properly set (Internet Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9793-1</ident>
      <fixtext fixref="F-23262r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; “Only allow approved domains to use ActiveX controls without prompt” will be set to “Enabled” and “Enable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 120B to REG_DWORD = 3.</fixtext>
      <fix id="F-23262r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:84" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22156">
    <title>DTBI840 - Cross-Site Scripting Filter - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25717r1_rule" severity="medium" weight="10.0">
      <version>DTBI840</version>
      <title>Turn on Cross-Site Scripting (XSS) Filter property is properly set (Internet Zone).</title>
      <description>&lt;VulnDiscussion&gt;The Cross-Site Scripting (XSS) Filter is designed to prevent users from becoming victims of unintentional information disclosure.  This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into Web sites in this zone.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10276-4</ident>
      <fixtext fixref="F-23263r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone -&gt; “Turn on Cross-Site Scripting (XSS) Filter” will be set to “Enabled” and “Enable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 1409 to REG_DWORD = 0.</fixtext>
      <fix id="F-23263r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnonCrossSiteScriptingFilter_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25400" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:254" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22157">
    <title>DTBI850 - Browser scripting control - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25719r1_rule" severity="medium" weight="10.0">
      <version>DTBI850</version>
      <title>Allow scripting of Internet Explorer web browser control property is properly configured (Restricted Sites Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether a page may control embedded WebBrowser Controls via script.  If you do not configure this policy setting, script access to the WebBrowser Control can be enabled or disabled by the user.  By default, script access to the WebBrowser Control is only allowed in the Local Machine and Intranet Zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10725-0</ident>
      <fixtext fixref="F-23264r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Allow scripting of Internet Explorer web browser control” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1206 to REG_DWORD = 3.</fixtext>
      <fix id="F-23264r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowScriptingOfInternetExplorerWebBrowserControl_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:85" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22158">
    <title>DTBI860 - Local directory paths - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25721r1_rule" severity="medium" weight="10.0">
      <version>DTBI860</version>
      <title>Include local directory path when uploading files to a server is properly set (Restricted Sites Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether or not the local path information will be sent when uploading a file via a HTML form.  If the local path information is sent, some information may be unintentionally revealed to the server.  If you do not configure this policy setting, the user can choose whether path information will be sent when uploading a file via a form.  By default, path information will be sent.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9781-6</ident>
      <fixtext fixref="F-23265r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Include local directory path when uploading files to a server” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 160A to REG_DWORD = 3.</fixtext>
      <fix id="F-23265r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IncludeLocalDirectoryPathWhenUploadingFilesToAServer_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:86" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22159">
    <title>DTBI870 - Programs and unsafe files - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25723r1_rule" severity="medium" weight="10.0">
      <version>DTBI870</version>
      <title>Launching programs and unsafe files property is properly set (Restricted Sites Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether or not the “Open File – Security Warning” prompt is shown when launching executables or other unsafe files.  If you do not configure this policy setting, users can configure the prompt behavior.  By default, execution is blocked in the Restricted Zone, enabled in the Intranet and Local Computer Zones, and set to prompt in the Internet and Trusted Zones.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10744-1</ident>
      <fixtext fixref="F-23266r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Launching programs and unsafe files” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1806 to REG_DWORD = 3.</fixtext>
      <fix id="F-23266r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="LaunchingProgramsAndUnsafeFiles_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:87" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22160">
    <title>DTBI880 - ActiveX controls no prompt - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25725r1_rule" severity="medium" weight="10.0">
      <version>DTBI880</version>
      <title>Only allow approved domains to use ActiveX controls without prompt property is properly set (Restricted Sites Zone).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on Web sites other than the Web site that installed the ActiveX control.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-9832-7</ident>
      <fixtext fixref="F-23267r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Only allow approved domains to use ActiveX controls without prompt” will be set to “Enabled” and “Enable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 120B to REG_DWORD = 3.</fixtext>
      <fix id="F-23267r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="OnlyAllowApprovedDomainsToUseActiveXControlsWithoutPrompt_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:88" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22161">
    <title>DTBI890 - Cross-Site Scripting Filter - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25727r1_rule" severity="medium" weight="10.0">
      <version>DTBI890</version>
      <title>Turn on Cross-Site Scripting (XSS) Filter property is properly set (Restricted Sites Zone).</title>
      <description>&lt;VulnDiscussion&gt;This setting controls if the Cross-Site Scripting (XSS) Filter detects and prevents cross-site script injection into Web sites in this zone.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10105-5</ident>
      <fixtext fixref="F-23268r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone -&gt; “Turn on Cross-Site Scripting (XSS) Filter” will be set to “Enabled” and “Enable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1409 to REG_DWORD = 0.</fixtext>
      <fix id="F-23268r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="TurnonCrossSiteScriptingFilter_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:8900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:89" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22171">
    <title>DTBI900 - Restrict ActiveX Install - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-25809r1_rule" severity="medium" weight="10.0">
      <version>DTBI900</version>
      <title>Internet Explorer Processes Restrict ActiveX Install (Reserved) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.  If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23277r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Restrict ActiveX Install -&gt; “Internet Explorer Processes” will be set to “Enabled”.

Procedure:  Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL  Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-23277r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcessesRestrictActiveX_Reserved_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25500" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:255" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22634">
    <title>DTBI910 - Status bar updates via script - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-26380r1_rule" severity="medium" weight="10.0">
      <version>DTBI910</version>
      <title>Allow status bar updates via script (Internet Zone) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether script is allowed to update the status bar within the zone.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-23573r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone “Allow status bar updates via script” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2103 to REG_DWORD = 3.</fixtext>
      <fix id="F-23573r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowStatusBarUpdates_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25600" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:256" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22635">
    <title>DTBI920 - .NET w/Authenticode unsigned - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-26382r1_rule" severity="medium" weight="10.0">
      <version>DTBI920</version>
      <title>Run .NET Framework-reliant components not signed with Authenticode (Internet Zone) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer.  These components include managed controls referenced from an object tag and managed executables referenced from a link.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10515-5</ident>
      <fixtext fixref="F-23577r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone “Run .NET Framework-reliant components not signed with Authenticode” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2004 to REG_DWORD = 3.</fixtext>
      <fix id="F-23577r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="RunNETFrameworkReliantComponentsNotSignedWithAuthenticode_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:9000" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:90" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22636">
    <title>DTBI930 - .NET w/Authenticode signed - Internet</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-26386r1_rule" severity="medium" weight="10.0">
      <version>DTBI930</version>
      <title>Run .NET Framework-reliant components signed with Authenticode (Internet Zone) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer.  These components include managed controls referenced from an object tag and managed executables referenced from a link.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10625-2</ident>
      <fixtext fixref="F-23579r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Internet Zone “Run .NET Framework-reliant components signed with Authenticode” will be set to “Enabled” and “Disable”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Criteria: Set the value 2001 to REG_DWORD = 3.</fixtext>
      <fix id="F-23579r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="RunNETFrameworkReliantComponentsSignedWithAuthenticode_InternetZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:9100" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:91" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22637">
    <title>DTBI940 - Scriptlets - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-26389r1_rule" severity="medium" weight="10.0">
      <version>DTBI940</version>
      <title>Allow Scriptlets (Restricted Sites Zone) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether scriptlets can be allowed.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10630-2</ident>
      <fixtext fixref="F-23581r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone “Allow Scriptlets” will be set to “Enabled” and “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 1209 to REG_DWORD = 3.</fixtext>
      <fix id="F-23581r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowScriptlets_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:9200" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:92" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22638">
    <title>DTBI950 - Status bar update by script - Restricted</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-26392r1_rule" severity="medium" weight="10.0">
      <version>DTBI950</version>
      <title>Allow status bar updates via script (Restricted Sites Zone) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether script is allowed to update the status bar within the zone.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <ident system="http://cce.mitre.org">CCE-10431-5</ident>
      <fixtext fixref="F-23583r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel -&gt; Security Page -&gt; Restricted Sites Zone “Allow status bar updates via script” will be set to “Enabled” and “Disabled”. Procedure: Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Criteria: Set the value 2103 to REG_DWORD = 3.</fixtext>
      <fix id="F-23583r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="AllowStatusBarUpdates_RestrictedSitesZone_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25700" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:257" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22687">
    <title>DTBI1010 - Restrict ActiveX Install - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-27076r1_rule" severity="medium" weight="10.0">
      <version>DTBI1010</version>
      <title>Internet Explorer Processes Restrict ActiveX Install (Explorer) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.  If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-24350r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Restrict ActiveX Install -&gt; “Internet Explorer Processes” will be set to “Enabled”.

Procedure:  Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL  Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-24350r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcessesRestrictActiveX_Explorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25800" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:258" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-22688">
    <title>DTBI1020 - Restrict ActiveX Install - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-27078r1_rule" severity="medium" weight="10.0">
      <version>DTBI1020</version>
      <title>Internet Explorer Processes Restrict ActiveX Install (IExplorer) property is properly set.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.  If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-24351r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features -&gt; Restrict ActiveX Install -&gt; “Internet Explorer Processes” will be set to “Enabled”.

Procedure:  Use the Windows Registry Editor to navigate to the following key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL  Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-24351r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-export value-id="IEProcessesRestrictActiveX_Iexplorer_LocalComputer_var" export-name="oval:mil.disa.fso.ie:var:25900" />
        <check-content-ref name="oval:mil.disa.fso.ie:def:259" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-30777">
    <title>DTBI775 - Internet Explorer Update Checking</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-44837r1_rule" severity="medium" weight="10.0">
      <version>DTBI775</version>
      <title>Automatic checking for Internet Explorer updates is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available. If you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available. Newer versions might not comply with the Internet Explorer version requirements of the organization. &lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-38274r2_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Internet Control Panel-&gt; Advanced Page-&gt; "Automatically check for Internet Explorer updates" will be set to “Disabled”. 

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Internet Explorer\Main 

Criteria: Set the value NoUpdateCheck to REG_DWORD = 1.</fixtext>
      <fix id="F-38274r2_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.ie:def:412" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-30778">
    <title>DTBI805 - Opt-In Prompts for ActiveX</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-44923r1_rule" severity="medium" weight="10.0">
      <version>DTBI805</version>
      <title>ActiveX opt-in prompt is not disabled.</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to turn off the ActiveX opt-in prompt. The ActiveX opt-in prevents Web sites from loading any COM object without prior approval.  If a page attempts to load a COM object that Internet Explorer has not used before, an Information bar will appear asking the user for approval.  If you enable this policy setting, the ActiveX opt-in prompt will not appear.  Internet Explorer does not ask the user for permission to load a control, and will load the ActiveX if it passes all other internal security checks.  If you disable or do not configure this policy setting the ActiveX opt-in prompt will appear.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-34625r1_fix">Set the policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; "Turn off ActiveX opt-in prompt" to “Enabled”.</fixtext>
      <fixtext fixref="F-38356r1_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; "Turn off ActiveX opt-in prompt" will be set to “Enabled”. 

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Ext 

Criteria: Set the value NoFirsttimeprompt to REG_DWORD = 1.</fixtext>
      <fix id="F-34625r1_fix" />
      <fix id="F-38356r1_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.ie:def:413" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-30779">
    <title>DTBI815 - Notification Bar Process - Reserved</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-44854r2_rule" severity="medium" weight="10.0">
      <version>DTBI815</version>
      <title>Internet Explorer Processes for Information bars are enforced (Reserved).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether the Information bar is displayed for Internet Explorer processes when file or code installs are restricted.  By default, the Information bar is displayed for Internet Explorer processes.  If you enable this policy setting, the Information bar will be displayed for Internet Explorer Processes.  If you disable this policy setting, the Information bar will not be displayed for Internet Explorer processes.  If you do not configure this policy setting, the Information bar will be displayed for Internet Explorer Processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-38286r3_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features-&gt; Information Bar-&gt; "Internet Explorer Processes" will be set to “Enabled”. 

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND 

Criteria: Set the value (Reserved) to REG_SZ = 1.</fixtext>
      <fix id="F-38286r3_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.ie:def:414" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-30780">
    <title>DTBI825 - Notification Bar Processes - Explorer</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-44908r2_rule" severity="medium" weight="10.0">
      <version>DTBI825</version>
      <title>Internet Explorer Processes for Information bars is not enforced (Explorer).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether the Information bar is displayed for Internet Explorer processes when file or code installs are restricted.  By default, the information bar is displayed for Internet Explorer processes.  If you enable this policy setting, the Information bar will be displayed for Internet Explorer Processes.  If you disable this policy setting, the Information bar will not be displayed for Internet Explorer processes.  If you do not configure this policy setting, the Information bar will be displayed for Internet Explorer Processes&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-38341r2_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features-&gt; Information Bar-&gt; "Internet Explorer Processes" will be set to “Enabled”. 

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND 

Criteria: Set the value explorer.exe to REG_SZ = 1.</fixtext>
      <fix id="F-38341r2_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.ie:def:415" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
  <Group id="V-30781">
    <title>DTBI835 - Notification Bar Processes - IExplore</title>
    <description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description>
    <Rule id="SV-44910r2_rule" severity="medium" weight="10.0">
      <version>DTBI835</version>
      <title>Internet Explorer Processes for Information bars is not enforced (IExplore).</title>
      <description>&lt;VulnDiscussion&gt;This policy setting allows you to manage whether the Information bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Information bar is displayed for Internet Explorer processes. If you enable this policy setting, the Information bar will be displayed for Internet Explorer processes. If you disable this policy setting, the Information bar will not be displayed for Internet Explorer processes. If you do not configure this policy setting, the Information bar will be displayed for Internet Explorer processes.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SeverityOverrideGuidance&gt;&lt;/SeverityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;System Administrator&lt;/Responsibility&gt;&lt;IAControls&gt;ECSC-1&lt;/IAControls&gt;</description>
      <reference>
        <dc:title>DPMS Target IE Version 8</dc:title>
        <dc:publisher>DISA FSO</dc:publisher>
        <dc:type>DPMS Target</dc:type>
        <dc:subject>IE Version 8</dc:subject>
        <dc:identifier>1682</dc:identifier>
      </reference>
      <fixtext fixref="F-38343r2_fix">The policy value for Computer Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; Internet Explorer -&gt; Security Features-&gt; Information Bar-&gt; "Internet Explorer Processes" will be set to “Enabled”. 

Procedure: Use the Windows Registry Editor to navigate to the following key:
HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND 

Criteria: Set the value iexplore.exe to REG_SZ = 1.</fixtext>
      <fix id="F-38343r2_fix" />
      <check system="http://oval.mitre.org/XMLSchema/oval-definitions-5">
        <check-content-ref name="oval:mil.disa.fso.ie:def:416" href="stig-ie8-oval.xml" />
      </check>
    </Rule>
  </Group>
</Benchmark>

