Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow software to run or install even if the signature is invalid

This Internet Explorer policy controls whether users can install or run software whose digital signature is invalid.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Download\RunInvalidSignatures
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Download\RunInvalidSignatures

This Internet Explorer policy controls whether users can install or run software whose digital signature is invalid. Its scope includes software such as ActiveX controls and files downloaded through Internet Explorer.

When the policy is enabled, Internet Explorer displays a security prompt. Installation or execution proceeds only if the user confirms the action. When the policy is disabled, Internet Explorer prevents files with invalid signatures from being installed or run. If the policy is not configured, users can choose whether to proceed.

The HKLM entry represents the computer policy, while the HKCU entry applies to the current user.

Notes

Security

An invalid signature can indicate that a file was modified after it was signed or that its origin cannot be authenticated reliably. Allowing users to approve the prompt can therefore expose the system to tampered or otherwise untrusted code.

This policy does not make an invalid signature valid, nor does it remove the security prompt. It only permits the user to bypass Internet Explorer's signature-related block after confirmation. Other security controls and the permissions required to install or execute the software continue to apply.

Possible side effects

Blocking files with invalid signatures can prevent legitimate legacy software or approved ActiveX controls from working. This can affect older web applications that depend on Internet Explorer components.

Notes

This is an Internet Explorer administrative-template policy, not a system-wide Windows code-signing policy. It does not determine whether arbitrary executable files can run throughout Windows.

The Internet Explorer 11 desktop application is retired or disabled on certain Windows versions. The policy therefore has a practical effect only where a component that consumes this Internet Explorer setting remains in use.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – AllowSoftwareWhenSignatureIsInvalid

Microsoft Learn: Internet Explorer 11 desktop application ended support for certain operating systems

See also