Scripted Window Security Restrictions

Verified with Microsoft 365/Office 5568.1000 — updated on September 4, 2026

Microsoft 365/Office 5568.1000

Supported on: At least Windows Server 2008 R2 or Windows 7

Path in the GPO console

Computer Configuration\Administrative Templates\Microsoft Office 2016 (Machine)\Security Settings\IE Security

Description

Window Restrictions

Registry

HKLM software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions

More options available

Options

groove.exe

groove.exe boolean

excel.exe

excel.exe boolean

mspub.exe

mspub.exe boolean

powerpnt.exe

powerpnt.exe boolean

pptview.exe

pptview.exe boolean

visio.exe

visio.exe boolean

winproj.exe

winproj.exe boolean

winword.exe

winword.exe boolean

outlook.exe

outlook.exe boolean

spDesign.exe

spdesign.exe boolean

exprwd.exe

exprwd.exe boolean

msaccess.exe

msaccess.exe boolean

onent.exe

onenote.exe boolean

mse7.exe

mse7.exe boolean

Export Builder

BETA

Configure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.

These exports write the registry — this is not a managed GPO. ⓘ

Not configured Enabled Disabled

.reg file

Windows Registry Editor Version 5.00

; Exported from gporais.com
; Policy: Scripted Window Security Restrictions
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7

[HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions]
"groove.exe"=dword:00000000
"excel.exe"=dword:00000000
"mspub.exe"=dword:00000000
"powerpnt.exe"=dword:00000000
"pptview.exe"=dword:00000000
"visio.exe"=dword:00000000
"winproj.exe"=dword:00000000
"winword.exe"=dword:00000000
"outlook.exe"=dword:00000000
"spdesign.exe"=dword:00000000
"exprwd.exe"=dword:00000000
"msaccess.exe"=dword:00000000
"onenote.exe"=dword:00000000
"mse7.exe"=dword:00000000

More formats (PowerShell, Intune, SCCM)

PowerShell

# Exported from gporais.com
# Policy: Scripted Window Security Restrictions
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7

$path = 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'groove.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'pptview.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'spdesign.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'exprwd.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mse7.exe' -Value 0 -Type DWord

Intune XML

No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.

Intune Remediation

# === Detection script ===
# Exported from gporais.com
# Policy: Scripted Window Security Restrictions
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'groove.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'excel.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'mspub.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'powerpnt.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'pptview.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'visio.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'winproj.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'winword.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'outlook.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'spdesign.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'exprwd.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'msaccess.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'onenote.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'mse7.exe' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Scripted Window Security Restrictions
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7

$path = 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'groove.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'pptview.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'spdesign.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'exprwd.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mse7.exe' -Value 0 -Type DWord

SCCM scripts

# Exported from gporais.com
# Policy: Scripted Window Security Restrictions
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.

# === Detection script ===
# Exported from gporais.com
# Policy: Scripted Window Security Restrictions
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'groove.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'excel.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'mspub.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'powerpnt.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'pptview.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'visio.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'winproj.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'winword.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'outlook.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'spdesign.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'exprwd.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'msaccess.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'onenote.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions' -Name 'mse7.exe' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Scripted Window Security Restrictions
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7

$path = 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'groove.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'pptview.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'spdesign.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'exprwd.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mse7.exe' -Value 0 -Type DWord

Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.

Open the Builder

Search GPORais

Scripted Window Security Restrictions

Path in the GPO console

Description

Registry

Options

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Embed this policy on your site

Scripted Window Security Restrictions

Path in the GPO console

Description

Registry

Options

Export Builder

.reg file

PowerShell

Intune XML

Intune Remediation

SCCM scripts

Related settings

In the same console folder: “IE Security”