Ensure 'Configure InPrivate mode availability' is set to 'Enabled: InPrivate mode disabled' (CIS LEVEL 1)

Created:2023/03/16 | Revised:2024/10/25

A level of security risk associated with vulnerability exploitation and its CVSS score.

Overview

1.64 'Configure InPrivate mode availability' policy setting recommended state is 'Enabled: InPrivate mode disabled'

Description

This policy specifies whether the user can open pages in InPrivate mode in Microsoft Edge.

InPrivate mode opens a new dedicated window that prevents websites, cookies, and trackers from accessing your browsing activity. When you close your InPrivate windows, all your browsing and download history is automatically deleted by Microsoft Edge, along with cached images, passwords, and autofill form data.

Policy options mapping:

  • Enabled (0) = InPrivate mode available
  • Disabled (1) = InPrivate mode disabled
  • Forced (2) = InPrivate mode forced

If you don't configure this policy or set it to 'Enabled', users can open pages in InPrivate mode.

If you set this policy to InPrivate mode disabled (the recommended configuration) users will not be able to initiate the InPrivate browsing mode for Microsoft Edge.

Impact

Disabling InPrivate mode for Microsoft Edge will ensure that browsing data is logged on the system that may be important for a computer investigation and investigators such as Computer Forensics Analysts may not be able to retrieve pertinent information to the investigation.

Solution

To configure the policy as recommended, follow the steps below (choose one of the suggested ways):

Fix using the Console

This vulnerability can be automatically fixed within the console.

Check the example of Automated Remediation Workflow implementation.

Using Local Group Policy Editor

  • Press Windows+R keys and type 'gpedit.msc' and press OK;

  • Navigate to: Computer Configuration > Administrative Templates > Microsoft Edge
  • On the right pane double click the 'Configure InPrivate mode availability' policy setting

  • Set it to 'Enabled'
  • In the options pane choose 'InPrivate mode disabled' from the drop-down list
  • Click 'Ok'

Microsoft Edge folders do not exist by default, the Group Policy template MSEdge.admx/adml should be downloaded from Microsoft.

Use our tutorial on How to install Microsoft Edge Group Policy templates on Windows 10 (for individual computers).

For a domain environment adding the templates through Active Directory is required.