Disable Known Folders
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2008 R2 or Windows 7
Path in the GPO console
User Configuration\Administrative Templates\Windows Components\File Explorer Description
This policy setting allows you to specify a list of known folders that should be disabled. Disabling a known folder will prevent the underlying file or directory from being created via the known folder API. If the folder exists before the policy is applied, the folder must be manually deleted since the policy only blocks the creation of the folder. You can specify a known folder using its known folder id or using its canonical name. For example, the Sample Videos known folder can be disabled by specifying {440fcffd-a92b-4739-ae1a-d4a54907c53f} or SampleVideos. Note: Disabling a known folder can introduce application compatibility issues in applications that depend on the existence of the known folder.
Registry
HKCU
Software\Policies\Microsoft\Windows\Explorer Value name: DisableKnownFolders
Enabled: DisableKnownFolders = 1
Disabled: DisableKnownFolders = 0
MDM / Intune (CSP)
./User/Vendor/MSFT/Policy/Config/ADMX_WindowsExplorer/DisableKnownFolders Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Disable Known Folders
; State: Enabled
; Supported on: At least Windows Server 2008 R2 or Windows 7
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer]
"DisableKnownFolders"=dword:00000001
[HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders]
; List values: enter one value per line in the builder UI.More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Disable Known Folders
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableKnownFolders' -Value 1 -Type DWord
$path = 'HKCU:\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Intune XML
OMA-URI: ./User/Vendor/MSFT/Policy/Config/ADMX_WindowsExplorer/DisableKnownFolders
Data type: String
Value:
<enabled/>
<!-- DisableKnownFolders_Prompt: enter one value per line before copying this XML payload. -->Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Disable Known Folders
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKCU:\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\Explorer' -Name 'DisableKnownFolders' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Disable Known Folders
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableKnownFolders' -Value 1 -Type DWord
$path = 'HKCU:\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.SCCM scripts
# Exported from gporais.com
# Policy: Disable Known Folders
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Disable Known Folders
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
# HKCU:\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders: List values: enter one value per line in the builder UI.
$checks = @(
(Test-RegistryValue -Path 'HKCU:\Software\Policies\Microsoft\Windows\Explorer' -Name 'DisableKnownFolders' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Disable Known Folders
# State: Enabled
# Supported on: At least Windows Server 2008 R2 or Windows 7
# Warning: In SYSTEM context (the Intune default), HKCU targets the SYSTEM profile. Run this script using the logged-on credentials.
$path = 'HKCU:\Software\Policies\Microsoft\Windows\Explorer'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableKnownFolders' -Value 1 -Type DWord
$path = 'HKCU:\Software\Policies\Microsoft\Windows\Explorer\DisableKnownFolders'
New-Item -Path $path -Force | Out-Null
# List values: enter one value per line in the builder UI.Building a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.