Define Activation Security Check exemptions
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows XP Professional with SP2
Path in the GPO console
Computer Configuration\Administrative Templates\System\Distributed COM\Application Compatibility Settings Description
Allows you to view and change a list of DCOM server application ids (appids) which are exempted from the DCOM Activation security check. DCOM uses two such lists, one configured via Group Policy through this policy setting, and the other via the actions of local computer administrators. DCOM ignores the second list when this policy setting is configured, unless the "Allow local activation security check exemptions" policy is enabled. DCOM server appids added to this policy must be listed in curly-brace format. For example: {b5dcb061-cefb-42e0-a1be-e6a6438133fe}. If you enter a non-existent or improperly formatted appid DCOM will add it to the list without checking for errors. If you enable this policy setting, you can view and change the list of DCOM activation security check exemptions defined by Group Policy settings. If you add an appid to this list and set its value to 1, DCOM will not enforce the Activation security check for that DCOM server. If you add an appid to this list and set its value to 0 DCOM will always enforce the Activation security check for that DCOM server regardless of local settings. If you disable this policy setting, the appid exemption list defined by Group Policy is deleted, and the one defined by local computer administrators is used. If you do not configure this policy setting, the appid exemption list defined by local computer administrators is used. Notes: The DCOM Activation security check is done after a DCOM server process is started, but before an object activation request is dispatched to the server process. This access check is done against the DCOM server's custom launch permission security descriptor if it exists, or otherwise against the configured defaults. If the DCOM server's custom launch permission contains explicit DENY entries this may mean that object activations that would have previously succeeded for such specified users, once the DCOM server process was up and running, might now fail instead. The proper action in this situation is to re-configure the DCOM server's custom launch permission settings for correct security settings, but this policy setting may be used in the short-term as an application compatibility deployment aid. DCOM servers added to this exemption list are only exempted if their custom launch permissions do not contain specific LocalLaunch, RemoteLaunch, LocalActivate, or RemoteActivate grant or deny entries for any users or groups. Also note, exemptions for DCOM Server Appids added to this list will apply to both 32-bit and 64-bit versions of the server if present.
Registry
Software\Policies\Microsoft\Windows NT\DCOM\AppCompat Value name: ListBox_Support_ActivationSecurityCheckExemptionList
Enabled: ListBox_Support_ActivationSecurityCheckExemptionList = 1
Disabled: ListBox_Support_ActivationSecurityCheckExemptionList = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_DCOM/DCOMActivationSecurityCheckExemptionList Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Define Activation Security Check exemptions
; State: Enabled
; Supported on: At least Windows XP Professional with SP2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat]
"ListBox_Support_ActivationSecurityCheckExemptionList"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Define Activation Security Check exemptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ListBox_Support_ActivationSecurityCheckExemptionList' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_DCOM/DCOMActivationSecurityCheckExemptionList
Data type: String
Value:
<enabled/>
<!-- DCOM_Lbl_ActSecCheckExemptionList: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Define Activation Security Check exemptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat' -Name 'ListBox_Support_ActivationSecurityCheckExemptionList' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Define Activation Security Check exemptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ListBox_Support_ActivationSecurityCheckExemptionList' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Define Activation Security Check exemptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Define Activation Security Check exemptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat' -Name 'ListBox_Support_ActivationSecurityCheckExemptionList' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Define Activation Security Check exemptions
# State: Enabled
# Supported on: At least Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'ListBox_Support_ActivationSecurityCheckExemptionList' -Value 1 -Type DWord
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\DCOM\AppCompat\ActivationSecurityCheckExemptionList'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.