Turn off automatic download of the ActiveX VersionList
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Internet Explorer 8.0
Path in the GPO console
User Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management Description
This setting determines whether IE automatically downloads updated versions of Microsoft’s VersionList.XML. IE uses this file to determine whether an ActiveX control should be stopped from loading. If you enable this setting, IE stops downloading updated versions of VersionList.XML. Turning off this automatic download breaks the out-of-date ActiveX control blocking feature by not letting the version list update with newly outdated controls, potentially compromising the security of your computer. If you disable or don't configure this setting, IE continues to download updated versions of VersionList.XML. For more information, see "Out-of-date ActiveX control blocking" in the Internet Explorer TechNet library.
Registry
HKCU
Software\Microsoft\Internet Explorer\VersionManager Value name: DownloadVersionList
Enabled: DownloadVersionList = 0
Disabled: DownloadVersionList = 1
MDM / Intune (CSP)
./User/Vendor/MSFT/Policy/Config/InternetExplorer/DisableActiveXVersionListAutoDownload Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Turn off automatic download of the ActiveX VersionList
; State: Enabled
; Supported on: At least Internet Explorer 8.0
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\VersionManager]
"DownloadVersionList"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Turn off automatic download of the ActiveX VersionList
# State: Enabled
# Supported on: At least Internet Explorer 8.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Microsoft\Internet Explorer\VersionManager'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DownloadVersionList' -Value 0 -Type DWordIntune XML
OMA-URI: ./User/Vendor/MSFT/Policy/Config/InternetExplorer/DisableActiveXVersionListAutoDownload
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Turn off automatic download of the ActiveX VersionList
# State: Enabled
# Supported on: At least Internet Explorer 8.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Microsoft\Internet Explorer\VersionManager' -Name 'DownloadVersionList' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn off automatic download of the ActiveX VersionList
# State: Enabled
# Supported on: At least Internet Explorer 8.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Microsoft\Internet Explorer\VersionManager'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DownloadVersionList' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Turn off automatic download of the ActiveX VersionList
# State: Enabled
# Supported on: At least Internet Explorer 8.0
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Turn off automatic download of the ActiveX VersionList
# State: Enabled
# Supported on: At least Internet Explorer 8.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Microsoft\Internet Explorer\VersionManager' -Name 'DownloadVersionList' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn off automatic download of the ActiveX VersionList
# State: Enabled
# Supported on: At least Internet Explorer 8.0
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Microsoft\Internet Explorer\VersionManager'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DownloadVersionList' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.