Menu Controls
Verified with Windows 11 25H2 — updated on July 23, 2026
Supported on: At least Internet Explorer 5.0
Path in the GPO console
User Configuration\Administrative Templates\Windows Components\Internet Explorer\Administrator Approved Controls Description
Designates a set of Microsoft ActiveX controls used to manipulate pop-up menus in the browser as administrator-approved. If you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run. If you disable this policy or do not configure it, these controls will not be designated as administrator-approved. To specify a control as administrator-approved, click Enabled, and then select the check box for the control: -- MCSiMenu - enables Web authors to control the placement and appearance of Windows pop-up menus on Web pages -- Popup Menu Object - enables Web authors to add pop-up menus to Web pages To specify how administrator-approved controls are handled for each security zone, carry out the following steps: 1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security. 2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings. 3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level. 4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.
Registry
HKCU
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Menu Controls
; State: Enabled
; Supported on: At least Internet Explorer 5.0
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls]
"{275E2FE0-7486-11D0-89D6-00A0C90C9B67}"=dword:00000000
"{7823A620-9DD9-11CF-A662-00AA00C066D2}"=dword:00000000
"{F5131C24-E56D-11CF-B78A-444553540000}"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Menu Controls
# State: Enabled
# Supported on: At least Internet Explorer 5.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name '{275E2FE0-7486-11D0-89D6-00A0C90C9B67}' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '{7823A620-9DD9-11CF-A662-00AA00C066D2}' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '{F5131C24-E56D-11CF-B78A-444553540000}' -Value 0 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Menu Controls
# State: Enabled
# Supported on: At least Internet Explorer 5.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls' -Name '{275E2FE0-7486-11D0-89D6-00A0C90C9B67}' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls' -Name '{7823A620-9DD9-11CF-A662-00AA00C066D2}' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls' -Name '{F5131C24-E56D-11CF-B78A-444553540000}' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Menu Controls
# State: Enabled
# Supported on: At least Internet Explorer 5.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name '{275E2FE0-7486-11D0-89D6-00A0C90C9B67}' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '{7823A620-9DD9-11CF-A662-00AA00C066D2}' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '{F5131C24-E56D-11CF-B78A-444553540000}' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Menu Controls
# State: Enabled
# Supported on: At least Internet Explorer 5.0
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Menu Controls
# State: Enabled
# Supported on: At least Internet Explorer 5.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls' -Name '{275E2FE0-7486-11D0-89D6-00A0C90C9B67}' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls' -Name '{7823A620-9DD9-11CF-A662-00AA00C066D2}' -Expected 0 -Kind DWord)
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls' -Name '{F5131C24-E56D-11CF-B78A-444553540000}' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Menu Controls
# State: Enabled
# Supported on: At least Internet Explorer 5.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedControls'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name '{275E2FE0-7486-11D0-89D6-00A0C90C9B67}' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '{7823A620-9DD9-11CF-A662-00AA00C066D2}' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name '{F5131C24-E56D-11CF-B78A-444553540000}' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.