Check for signatures on downloaded programs
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page Description
This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs. If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers. If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers. If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.
Registry
Software\Policies\Microsoft\Internet Explorer\Download Software\Policies\Microsoft\Internet Explorer\Download Value name: CheckExeSignatures
Enabled: CheckExeSignatures = yes
Disabled: CheckExeSignatures = no
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/InternetExplorer/CheckSignaturesOnDownloadedPrograms ./User/Vendor/MSFT/Policy/Config/InternetExplorer/CheckSignaturesOnDownloadedPrograms Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
Applying both scopes creates an ambiguous configuration (computer takes precedence over user). Only do this intentionally.
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Check for signatures on downloaded programs
; State: Enabled
; Scope: Computer (HKLM)
; Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Download]
"CheckExeSignatures"="yes"More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Check for signatures on downloaded programs
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
$path = 'HKLM:\Software\Policies\Microsoft\Internet Explorer\Download'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CheckExeSignatures' -Value 'yes' -Type StringIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/InternetExplorer/CheckSignaturesOnDownloadedPrograms
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Check for signatures on downloaded programs
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Internet Explorer\Download' -Name 'CheckExeSignatures' -Expected 'yes' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Check for signatures on downloaded programs
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
$path = 'HKLM:\Software\Policies\Microsoft\Internet Explorer\Download'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CheckExeSignatures' -Value 'yes' -Type StringSCCM scripts
# Exported from gporais.com
# Policy: Check for signatures on downloaded programs
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Check for signatures on downloaded programs
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Internet Explorer\Download' -Name 'CheckExeSignatures' -Expected 'yes' -Kind String)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Check for signatures on downloaded programs
# State: Enabled
# Scope: Computer (HKLM)
# Supported on: At least Internet Explorer 6.0 in Windows 2003 Service Pack 1
$path = 'HKLM:\Software\Policies\Microsoft\Internet Explorer\Download'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'CheckExeSignatures' -Value 'yes' -Type StringBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.