The encryption type for password protected Office 97 thru Office 2003 must be set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-238029	DTOO190	SV-238029r961128_rule		Medium

Description

STIG	Date
Microsoft Office System 2016 Security Technical Implementation Guide	2024-12-06

Details

Check Text (C-41239r650652_chk)

Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encryption type for password protected Office 97-2003 files" is set to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)".

Procedure: Use the Windows Registry Editor to navigate to the following key:

HKCU\Software\Policies\Microsoft\Office\16.0\common\security

Criteria: If the value DefaultEncryption12 is REG_SZ = "Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256", this is not a finding.

Fix Text (F-41198r650653_fix)

Set the policy value for User Configuration -> Administrative Templates -> Microsoft Office 2016 -> Security Settings "Encryption type for password protected Office 97-2003 files" to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider,AES 256,256)".