This policy setting determines whether digital certificates are processed when software restriction policies are enabled and a user or process attempts to run software with an .exe file name extension. It enables or disables certificate rules (a type of software restriction policies rule). With software restriction policies, you can create a certificate rule that will allow or disallow the execution of Authenticode-signed software, based on the digital certificate that is associated with the software. For certificate rules to take effect in software restriction policies, you must enable this policy setting. Countermeasure: Configure the System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies setting to Enabled. Potential Impact: If you enable certificate rules, software restriction policies check a certificate revocation list (CRL) to ensure that the software's certificate and signature are valid. This checking process may negatively affect performance when signed programs start. To disable this feature you can edit the software restriction policies in the desired GPO. On the Trusted Publishers Properties dialog box, clear the Publisher and Timestamp check boxes. [enabled/disabled] (1) GPO: Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\Security Options\\System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies (2) REG: HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers!AuthenticodeEnabled oval:org.secpod.oval:def:8482 HIPAA/HITECH Act Jericho Forum BITS Shared Assessments SIG v6.0 FedRAMP Security Controls(Final Release Jan 2012)--LOW IMPACT LEVEL-- ISO/IEC 27001-2005 COBIT 4.1 GAPP (Aug 2009) NERC CIP NIST SP800-53 R3 AC-6 NIST SP800-53 R3 SC-7 PCIDSS v2.0 FedRAMP Security Controls(Final Release Jan 2012)--MODERATE IMPACT LEVEL-- BITS Shared Assessments AUP v5.0 SCAP Repo OVAL Definition 2013-01-17 HIPAA/HITECH Act 2012-10-12 Jericho Forum 2012-10-12 BITS Shared Assessments SIG v6.0 2012-10-12 ISO/IEC 27001-2005 2012-10-12 COBIT 4.1 2012-10-12 GAPP (Aug 2009) 2012-10-12 NERC CIP 2012-10-12 NIST SP800-53 R3 2012-10-12 PCIDSS v2.0 2012-10-12 BITS Shared Assessments AUP v5.0 2012-10-12