Details

Determines whether websites that aren’t covered by ‘PluginsAllowedForUrls’ (Allow the Adobe Flash plug-in on specific sites) or ‘PluginsBlockedForUrls’ (Block the Adobe Flash plug-in on specific sites) can automatically run the Adobe Flash plug-in. You can select ‘BlockPlugins’ (2) to block Adobe Flash on all sites or you can select ‘ClickToPlay’ (3) to let Adobe Flash run but require the user to click the placeholder to start it. In any case the ‘PluginsAllowedForUrls’ and ‘PluginsBlockedForUrls’ policies take precedence over ‘DefaultPluginsSetting’.Automatic playback is only allowed for domains explicitly listed in the ‘PluginsAllowedForUrls’ policy. If you want to enable automatic playback for all sites consider adding http://* and https://* to this list.

If you don’t configure this policy the user can change this setting manually.* 2 = Block the Adobe Flash plug-in* 3 = Click to playThe former ‘1’ option set allow-all but this functionality is now only handled by the ‘PluginsAllowedForUrls’ policy. Existing policies using ‘1’ will operate in Click-to-play mode.

Solution

Policy Path: Microsoft EdgeContent settings
Policy Setting Name: Default Adobe Flash setting

Supportive Information

The following resource is also helpful.

• https://techcommunity.microsoft.com/t5/microsoft-security-baselines/security-baseline-for-microsoft-edge-v83/ba-p/1417634

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-7(4)

Source

• Tenable.com/audits