Activate Restricted Browsing

Verified with Microsoft 365/Office 5568.1000 — updated on September 4, 2026

Supported on: At least Windows Server 2008 R2 or Windows 7

Path in the GPO console

User Configuration\Administrative Templates\Microsoft Office 2016\File Open/Save dialog box\Restricted Browsing

Description

When Restricted Browsing is activated the save as dialog box will be restricted such that the user will only be able to navigate to those locations and the children of those locations specified in the "Restricted Browsing\Approve Locations" policy setting. If you want to enable the "Approve Locations" policy setting, you must first enable the "Approve Locations" policy setting first.

Registry

HKCU software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin

More options available

Options

Microsoft Access

microsoft access boolean

Microsoft Excel

microsoft excel boolean

Microsoft SharePoint Designer

microsoft sharepoint designer boolean

Microsoft InfoPath

microsoft infopath boolean

Microsoft OneNote

microsoft onenote boolean

Microsoft Outlook

microsoft outlook boolean

Microsoft PowerPoint

microsoft powerpoint boolean

Microsoft Project

microsoft project boolean

Microsoft Publisher

microsoft publisher boolean

Microsoft Visio

microsoft visio boolean

Microsoft Word

microsoft word boolean

Export Builder

BETA

Configure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.

These exports write the registry — this is not a managed GPO. ⓘ

Not configured Enabled Disabled

.reg file

Windows Registry Editor Version 5.00

; Exported from gporais.com
; Policy: Activate Restricted Browsing
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7

[HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin]
"microsoft access"=dword:00000000
"microsoft excel"=dword:00000000
"microsoft sharepoint designer"=dword:00000000
"microsoft infopath"=dword:00000000
"microsoft onenote"=dword:00000000
"microsoft outlook"=dword:00000000
"microsoft powerpoint"=dword:00000000
"microsoft project"=dword:00000000
"microsoft publisher"=dword:00000000
"microsoft visio"=dword:00000000
"microsoft word"=dword:00000000

More formats (PowerShell, Intune, SCCM)

PowerShell

# Exported from gporais.com
# Policy: Activate Restricted Browsing
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.

$path = 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'microsoft access' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft excel' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft sharepoint designer' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft infopath' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft onenote' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft outlook' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft powerpoint' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft project' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft publisher' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft visio' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft word' -Value 0 -Type DWord

Intune XML

No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.

Intune Remediation

# === Detection script ===
# Exported from gporais.com
# Policy: Activate Restricted Browsing
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft access' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft excel' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft sharepoint designer' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft infopath' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft onenote' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft outlook' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft powerpoint' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft project' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft publisher' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft visio' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft word' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Activate Restricted Browsing
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.

$path = 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'microsoft access' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft excel' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft sharepoint designer' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft infopath' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft onenote' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft outlook' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft powerpoint' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft project' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft publisher' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft visio' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft word' -Value 0 -Type DWord

SCCM scripts

# Exported from gporais.com
# Policy: Activate Restricted Browsing
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.

# === Detection script ===
# Exported from gporais.com
# Policy: Activate Restricted Browsing
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft access' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft excel' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft sharepoint designer' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft infopath' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft onenote' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft outlook' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft powerpoint' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft project' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft publisher' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft visio' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin' -Name 'microsoft word' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Activate Restricted Browsing
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.

$path = 'HKCU:\software\policies\microsoft\office\16.0\common\open find\restrictedbrowse\optin'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'microsoft access' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft excel' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft sharepoint designer' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft infopath' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft onenote' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft outlook' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft powerpoint' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft project' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft publisher' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft visio' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'microsoft word' -Value 0 -Type DWord

Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.

Open the Builder

Search GPORais

Activate Restricted Browsing

Path in the GPO console

Description

Registry

Options

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Embed this policy on your site

Activate Restricted Browsing

Path in the GPO console

Description

Registry

Options

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Related settings

In the same console folder: “Restricted Browsing”