Details
This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application.
The recommended state for this setting is: Enabled.
Rationale:
This service’s purpose is to help find an appropriate application for a file whose type is unrecognized by the computer. That could pose a security risk if the unrecognized file is malicious code, even if the application to be discovered is itself innocent. Enterprise environments tend to be very managed, where the IT staff decides which applications should and should not be installed.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled:
Computer ConfigurationPoliciesAdministrative TemplatesSystemInternet Communication ManagementInternet Communication settingsTurn off Internet File Association service
Note: This Group Policy path is provided by the Group Policy template ICM.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.
Impact:
The link and the dialog for using the Web service to open an unhandled file association are removed.
Default Value:
Disabled. (The user is allowed to use the Web service.)
References:
CCE-36215-2
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Windows.