List of allowed COM/VSTO add-ins registered in HKCU
Verified with Microsoft 365/Office 5568.1000 — updated on July 10, 2026
Supported on: At least Windows Server 2016, Windows 10
Path in the GPO console
User Configuration\Administrative Templates\Microsoft Office 2016\Security Settings Description
This policy setting allows you to specify COM/VSTO add-ins registered in HKEY_CURRENT_USER (HKCU) that should be allowed to load, overriding the "Block loading of COM/VSTO add-ins registered in HKCU" policy. Some legitimate add-ins may be installed in HKCU even when deployed by administrators, due to how the independent software vendor (ISV) designed their installer. This policy provides an administrative override to allow specific add-ins to load despite being registered in HKCU. If you enable this policy setting, you can specify a list of COM/VSTO add-ins that are allowed to load from HKCU. Enter each add-in using its ProgID as the name. If you disable or don't configure this policy setting, the standard HKCU blocking behavior applies when that policy is enabled.
Registry
HKCU
software\policies\microsoft\office\16.0\common\security\allowedcomaddins Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: List of allowed COM/VSTO add-ins registered in HKCU
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10
[HKEY_CURRENT_USER\software\policies\microsoft\office\16.0\common\security\allowedcomaddins]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: List of allowed COM/VSTO add-ins registered in HKCU
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\software\policies\microsoft\office\16.0\common\security\allowedcomaddins'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: List of allowed COM/VSTO add-ins registered in HKCU
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKCU:\software\policies\microsoft\office\16.0\common\security\allowedcomaddins: List values: enter one value per line in the builder UI.
# No testable registry values are available for this state.
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: List of allowed COM/VSTO add-ins registered in HKCU
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\software\policies\microsoft\office\16.0\common\security\allowedcomaddins'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: List of allowed COM/VSTO add-ins registered in HKCU
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: List of allowed COM/VSTO add-ins registered in HKCU
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKCU:\software\policies\microsoft\office\16.0\common\security\allowedcomaddins: List values: enter one value per line in the builder UI.
# No testable registry values are available for this state.
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: List of allowed COM/VSTO add-ins registered in HKCU
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\software\policies\microsoft\office\16.0\common\security\allowedcomaddins'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.