Restrict legacy JScript execution for Office
Vérifié avec Microsoft Security Baseline (MSS / SecGuide) 25H2 — mis à jour le 12 juillet 2026
Pris en charge sur : Windows Server 2016, Windows 10 version 1803 ou versions supérieures
Chemin dans la console GPO
Configuration ordinateur\Modèles d'administration\MS Security Guide Description
This policy setting controls JScript execution per Security Zone within Internet Explorer and WebBrowser Control (WebOC) for Office applications. It's important to determine whether legacy JScript is being used to provide business-critical functionality before you enable this setting. If Enabled, Office applications will not execute legacy JScript for the Internet or Restricted Sites zones and users aren’t notified by the application that legacy JScript execution is restricted. Modern JScript9 will continue to function for all zones. If Disabled or Not Configured JScript will function without any restrictions. The values are set in hexadecimal and should be converted prior to changing the setting value. To learn more about Internet Explorer Feature Control Key and the Restrict JScript process-level policy for Windows, please refer to: https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330734(v=vs.85)#restrict-jscript-at-a-process-level
Registre
HKLM
software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE Générateur d'exports
BETAConfigurez l'état, la portée et les options, puis générez les sorties .reg, PowerShell, Intune et SCCM — ou ajoutez le paramètre à une collection multi-paramètres.
Ces exports écrivent le registre — ce n'est pas une GPO managée. ⓘ
Fichier .reg
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Restrict legacy JScript execution for Office
; State: Enabled
; Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
[HKEY_LOCAL_MACHINE\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE]
"excel.exe"=dword:00011000
"mspub.exe"=dword:00011000
"powerpnt.exe"=dword:00011000
"onenote.exe"=dword:00011000
"visio.exe"=dword:00011000
"winproj.exe"=dword:00011000
"winword.exe"=dword:00011000
"outlook.exe"=dword:00011000
"msaccess.exe"=dword:00011000Autres formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
$path = 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 69632 -Type DWordIntune XML
Aucune correspondance directe Policy CSP / OMA-URI pour cette stratégie. Utilisez l'onglet Intune Remediation, ou importez l'ADMX dans Intune.Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'excel.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'mspub.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'powerpnt.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'onenote.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'visio.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winproj.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winword.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'outlook.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'msaccess.exe' -Expected 69632 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
$path = 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 69632 -Type DWordScripts SCCM
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'excel.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'mspub.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'powerpnt.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'onenote.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'visio.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winproj.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'winword.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'outlook.exe' -Expected 69632 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE' -Name 'msaccess.exe' -Expected 69632 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Restrict legacy JScript execution for Office
# State: Enabled
# Supported on: Windows Server 2016, Windows 10 version 1803 ou versions supérieures
$path = 'HKLM:\software\policies\microsoft\internet explorer\main\featurecontrol\FEATURE_RESTRICT_LEGACY_JSCRIPT_PER_SECURITY_ZONE'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'excel.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'mspub.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'powerpnt.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'onenote.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'visio.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winproj.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'winword.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'outlook.exe' -Value 69632 -Type DWord
Set-ItemProperty -Path $path -Name 'msaccess.exe' -Value 69632 -Type DWordVous construisez une collection multi-paramètres ? Ajoutez ce paramètre et générez des exports combinés (.reg, PowerShell, GPO).