Disable ActiveX Controls in Office 2007 to Mitigate CVE-2010-0249 on Windows

What the Office 2007 DisableAllActiveX Worklet does

This Automox Worklet™ sets the DisableAllActiveX value to 1 under HKLM\SOFTWARE\Microsoft\Office\12.0\Common\Security on Windows endpoints with Office 2007 installed.

CVE-2010-0249 is a use-after-free vulnerability in Microsoft Internet Explorer and the zero-day exploited in the Operation Aurora attacks of late 2009 and early 2010. CISA lists it in the Known Exploited Vulnerabilities (KEV) catalog. As a workaround, Microsoft Security Advisory 979352 and security bulletin MS10-002 list disabling ActiveX controls in Office 2007 through the Trust Center option Disable all controls without notification.

Why disable ActiveX controls in Office 2007

Office 2007 reached end of support on October 10, 2017, yet some endpoints still run it for a legacy application or template. Use this Worklet on those endpoints to keep the workaround in place until you retire Office 2007.

The Internet Explorer fix itself is the MS10-002 cumulative security update. CISA's required action for this KEV entry is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

How the DisableAllActiveX registry write works

1. Evaluation phase: Opens the 64-bit registry view and walks SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and its WOW6432Node counterpart for a DisplayName that matches Microsoft Office followed by 2007. If none matches, it exits 0 as not applicable. On a match, it opens HKLM\SOFTWARE\Microsoft\Office\12.0\Common\Security in the 64-bit view and reads the DisableAllActiveX value. If the value is 1, it exits 0 as compliant. If the key or value is missing, holds another value, or the registry can't be read, it exits 1 as non-compliant.

2. Remediation phase: Writes DisableAllActiveX as a DWORD of 1 in the 64-bit view and creates the Security key if it doesn't exist. Before that write, it saves the prior value (or the sentinel NOT_PRESENT) to C:\Program Files (x86)\Automox\WorkletCache\4ee97d00-f116-5675-9734-4d276c448208\prior-state.txt if that file doesn't exist yet. An existing backup stays unchanged, so it keeps the state from before the first change. The Worklet then reads the value back and exits 1 on a mismatch. Like evaluation, it skips endpoints without Office 2007. It also exits 0 without writing when the value is already 1.

Office 2007 DisableAllActiveX requirements

• Windows 10 or Windows 11 x64, or Windows Server 2016 and later, with PowerShell 5.1 or newer

• The Automox agent running as SYSTEM, for the write under HKLM

• An Office 2007 entry under the Uninstall registry keys

• You set the optional dryrun and rollback switches in the Worklet policy. Both sit at the top of the remediation script and default to false. With dryrun set to true, the script logs each step it would take with a DRYRUN prefix, then exits without changing state.

• To restore the prior value, set rollback to true and run remediation with Run Policy or FixNow using Remediation Only. Scheduled runs skip remediation once evaluation reports compliant. Rollback writes the recorded value back as a DWORD, or deletes the value when the backup reads NOT_PRESENT. If there's no backup file, it exits 1. Set rollback back to false afterward so later runs reapply the value.

Expected DisableAllActiveX registry state

You'll see Office 2007 endpoints move to compliant in Automox once DisableAllActiveX reads 1 under HKLM\SOFTWARE\Microsoft\Office\12.0\Common\Security in the 64-bit registry view. Any endpoint that still reports non-compliant gets the value on its next remediation run. Endpoints without Office 2007 report compliant too, with a not-applicable note in the log.

In the Activity Log, you'll find an entry for each step, from the Office 2007 detection to the registry write. The backup entry shows the prior value, or notes that an earlier backup was kept. After the write, the read-back check comes last.