Restrict legacy JScript execution for Office
Verified with Microsoft Security Baseline (MSS / SecGuide) 25H2 — updated on July 12, 2026
Supported on: At least Windows Server 2016, Windows 10 Version 1803
Path in the GPO console
Computer Configuration\Administrative Templates\MS Security Guide Description
This policy setting controls JScript execution per Security Zone within Internet Explorer and WebBrowser Control (WebOC) for Office applications. It's important to determine whether legacy JScript is being used to provide business-critical functionality before you enable this setting. If Enabled, Office applications will not execute legacy JScript for the Internet or Restricted Sites zones and users aren’t notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones. If Disabled or Not Configured JScript will function without any restrictions. The values are set in hexadecimal and should be converted prior to changing the setting value. To learn more about Internet Explorer Feature Control Key and the Restrict JScript process-level policy for Windows, please refer to: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330734(v=vs.85)#restrict-jscript-at-a-process-level
Registry
HKLM
software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Restrict legacy JScript execution for Office
; State: Enabled
; Supported on: At least Windows Server 2016, Windows 10 Version 1803
[HKEY_LOCAL_MACHINE\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE]
"excel.exe"=dword:00011000
"mspub.exe"=dword:00011000
"powerpnt.exe"=dword:00011000
"onenote.exe"=dword:00011000
"visio.exe"=dword:00011000
"winproj.exe"=dword:00011000
"winword.exe"=dword:00011000
"outlook.exe"=dword:00011000
"msaccess.exe"=dword:00011000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1803
$path = 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 69632 -Type DWordIntune XML
No direct Policy CSP / OMA-URI mapping for this policy. Use the Intune Remediation tab, or ingest the ADMX in Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1803
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'excel.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'mspub.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'powerpnt.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'onenote.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'visio.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winproj.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winword.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'outlook.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'msaccess.exe' -Expected 69632 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1803
$path = 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 69632 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1803
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1803
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'excel.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'mspub.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'powerpnt.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'onenote.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'visio.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winproj.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winword.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'outlook.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'msaccess.exe' -Expected 69632 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: At least Windows Server 2016, Windows 10 Version 1803
$path = 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 69632 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.