Restreindre le téléchargement de fichier

Vérifié avec Microsoft 365/Office 5568.1000 — mis à jour le 4 septembre 2026

Pris en charge sur : Au minimum Windows Server 2008 R2 ou Windows 7

Chemin dans la console GPO

Configuration ordinateur\Modèles d'administration\Microsoft Office 2016 (ordinateur)\Paramètres de sécurité\Sécurité IE

Description

Restreindre le téléchargement de fichier

Registre

HKLM software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload

Plus d'options disponibles

Options

groove.exe

groove.exe boolean

excel.exe

excel.exe boolean

mspub.exe

mspub.exe boolean

powerpnt.exe

powerpnt.exe boolean

pptview.exe

pptview.exe boolean

visio.exe

visio.exe boolean

winproj.exe

winproj.exe boolean

winword.exe

winword.exe boolean

outlook.exe

outlook.exe boolean

spDesign.exe

spdesign.exe boolean

exprwd.exe

exprwd.exe boolean

msaccess.exe

msaccess.exe boolean

onent.exe

onenote.exe boolean

mse7.exe

mse7.exe boolean

Générateur d'exports

BETA

Configurez l'état, la portée et les options, puis générez les sorties .reg, PowerShell, Intune et SCCM — ou ajoutez le paramètre à une collection multi-paramètres.

Ces exports écrivent le registre — ce n'est pas une GPO managée. ⓘ

Non configuré Activé Désactivé

Fichier .reg

Windows Registry Editor Version 5.00

; Exported from gporais.com
; Policy: Restreindre le téléchargement de fichier
; State: Enabled
; Supported on: Au minimum Windows Server 2008 R2 ou Windows 7

[HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload]
"groove.exe"=dword:00000000
"excel.exe"=dword:00000000
"mspub.exe"=dword:00000000
"powerpnt.exe"=dword:00000000
"pptview.exe"=dword:00000000
"visio.exe"=dword:00000000
"winproj.exe"=dword:00000000
"winword.exe"=dword:00000000
"outlook.exe"=dword:00000000
"spdesign.exe"=dword:00000000
"exprwd.exe"=dword:00000000
"msaccess.exe"=dword:00000000
"onenote.exe"=dword:00000000
"mse7.exe"=dword:00000000

Autres formats (PowerShell, Intune, SCCM)

PowerShell

# Exported from gporais.com
# Policy: Restreindre le téléchargement de fichier
# State: Enabled
# Supported on: Au minimum Windows Server 2008 R2 ou Windows 7

$path = 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'groove.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'pptview.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'spdesign.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'exprwd.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mse7.exe' -Value 0 -Type DWord

Intune XML

Aucune correspondance directe Policy CSP / OMA-URI pour cette stratégie. Utilisez l'onglet Intune Remediation, ou importez l'ADMX dans Intune.

Intune Remediation

# === Detection script ===
# Exported from gporais.com
# Policy: Restreindre le téléchargement de fichier
# State: Enabled
# Supported on: Au minimum Windows Server 2008 R2 ou Windows 7

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'groove.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'excel.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'mspub.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'powerpnt.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'pptview.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'visio.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'winproj.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'winword.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'outlook.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'spdesign.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'exprwd.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'msaccess.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'onenote.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'mse7.exe' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Restreindre le téléchargement de fichier
# State: Enabled
# Supported on: Au minimum Windows Server 2008 R2 ou Windows 7

$path = 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'groove.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'pptview.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'spdesign.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'exprwd.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mse7.exe' -Value 0 -Type DWord

Scripts SCCM

# Exported from gporais.com
# Policy: Restreindre le téléchargement de fichier
# State: Enabled
# Supported on: Au minimum Windows Server 2008 R2 ou Windows 7
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.

# === Detection script ===
# Exported from gporais.com
# Policy: Restreindre le téléchargement de fichier
# State: Enabled
# Supported on: Au minimum Windows Server 2008 R2 ou Windows 7

function Test-RegistryValue {
  param(
    [Parameter(Mandatory = $true)][string]$Path,
    [Parameter(Mandatory = $true)][string]$Name,
    [object]$Expected,
    [ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
    [switch]$Absent
  )

  try {
    $item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
  } catch {
    return $Absent.IsPresent
  }

  if ($Absent.IsPresent) { return $false }
  $actual = $item.$Name

  if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
  if ($Kind -eq 'MultiString') {
    $actualValues = @($actual)
    $expectedValues = @($Expected)
    if ($actualValues.Count -ne $expectedValues.Count) { return $false }
    for ($i = 0; $i -lt $expectedValues.Count; $i++) {
      if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
    }
    return $true
  }

  return [string]$actual -eq [string]$Expected
}

$checks = @(
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'groove.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'excel.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'mspub.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'powerpnt.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'pptview.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'visio.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'winproj.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'winword.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'outlook.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'spdesign.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'exprwd.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'msaccess.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'onenote.exe' -Expected 0 -Kind DWord)
  (Test-RegistryValue -Path 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload' -Name 'mse7.exe' -Expected 0 -Kind DWord)
)

if ($checks -notcontains $false) {
  Write-Output 'Compliant'
  exit 0
}

Write-Output 'Non-compliant'
exit 1

# === Remediation script ===
# Exported from gporais.com
# Policy: Restreindre le téléchargement de fichier
# State: Enabled
# Supported on: Au minimum Windows Server 2008 R2 ou Windows 7

$path = 'HKLM:\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'groove.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'pptview.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'spdesign.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'exprwd.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 0 -Type DWord
Set-ItemProperty -Path $path -Name 'mse7.exe' -Value 0 -Type DWord

Vous construisez une collection multi-paramètres ? Ajoutez ce paramètre et générez des exports combinés (.reg, PowerShell, GPO).

Ouvrir le Builder

Rechercher dans GPORais

Restreindre le téléchargement de fichier

Chemin dans la console GPO

Description

Registre

Options

Générateur d'exports

Fichier .reg

PowerShell

Intune XML

Intune Remediation

Scripts SCCM

Intégrer cette GPO sur votre site

Restreindre le téléchargement de fichier

Chemin dans la console GPO

Description

Registre

Options

Générateur d'exports

Fichier .reg

PowerShell

Intune XML

Intune Remediation

Scripts SCCM

Paramètres liés

Dans le même dossier de la console : “Sécurité IE”