Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

ActiveX Control Initialization

This user-scoped policy value controls how Office applications initialize ActiveX controls.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKCU\software\policies\microsoft\office\common\security\uficontrols

This user-scoped policy value controls how Office applications initialize ActiveX controls. Its behavior depends on whether a control is marked Safe for Initialization (SFI) or Unsafe for Initialization (UFI), whether the control is initialized in safe mode, and whether persisted values stored in the document are used.

The value is a REG_DWORD with the following meanings:

  • 1: Loads the control regardless of its SFI designation and uses persisted values when present. The user is not prompted.
  • 2: Loads SFI controls in safe mode with persisted values. A control not marked SFI is loaded without prompting in unsafe mode, using persisted values or, if none are present, its default first-time initialization values.
  • 3: Loads SFI controls in unsafe mode with persisted values. For a UFI control, Office warns the user and, following approval, initializes the control with default first-time values.
  • 4: Loads SFI controls in safe mode with persisted values. For a UFI control, Office warns the user and, following approval, initializes the control with default first-time values.
  • 5: Loads SFI controls in unsafe mode with persisted values. For a UFI control, Office warns the user and, following approval, loads the control with persisted values from the document.
  • 6: Loads SFI controls in safe mode with persisted values. For a UFI control, Office warns the user and, following approval, loads the control with persisted values from the document.

In this context, “safe mode” means a restricted initialization mode implemented by the ActiveX control. It is unrelated to starting an Office application in its diagnostic safe mode.

Notes

Security

ActiveX controls are executable active content. Depending on their implementation, they can access resources such as local files and registry settings. Values 1 and 2 allow UFI controls to load in unsafe mode without a prior user decision. A malicious document or vulnerable control can therefore execute code with the signed-in user's permissions.

Values 3 through 6 require a user decision before a UFI control is loaded. Values 4 and 6 also initialize SFI controls in safe mode. For UFI controls, values 3 and 4 are more restrictive than 5 and 6 because persisted state from the document is not supplied after approval.

The control's developer assigns the SFI designation. That designation does not guarantee that the control is free from defects or exploitable vulnerabilities. An ActiveX kill bit prevents a particular control from running regardless of this setting.

Possible side effects

Safe-mode initialization can restrict features that a control normally provides in unsafe mode. Documents or forms that depend on those features might not work completely.

When a UFI control is initialized with default values instead of its persisted values, its previously stored state is unavailable. This can alter its presentation, calculations, or other document-dependent behavior. User prompts can also interrupt automated or unattended processing.

Notes

This is a shared Office setting rather than a per-application setting. Other protections—including policies that disable all ActiveX controls, kill bits, trusted documents or locations, and application-specific security checks—can also determine the resulting behavior.

Not every ActiveX control correctly honors the requested safe initialization mode. Microsoft notes that some controls can still load persisted data even when safe mode has been requested.

Microsoft 365 and Office 2024 now disable ActiveX controls by default. That newer default should not be confused with the value semantics of this Office 16 policy.

Microsoft documentation

Microsoft Support: Enable or disable ActiveX settings in Office files

Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference

Microsoft Support: ActiveX controls are disabled by default in Microsoft 365 and Office 2024

See also