Restrict Apps from FPRPC Fallback
This per-user registry value controls whether Microsoft 365 apps may fall back to the legacy FrontPage Server Extensions Remote Procedure Call (FPRPC) protocol when opening files.
since 0.9.8.11
Purpose
Show registry keys (1)
HKCU\software\policies\microsoft\office\16.0\common\fileio\blockwecfallback
This per-user registry value controls whether Microsoft 365 apps may fall back to the legacy FrontPage Server Extensions Remote Procedure Call (FPRPC) protocol when opening files.
The value uses the REG_DWORD data type. A value of 1 blocks FPRPC fallback. The app attempts to open the file over HTTPS instead, and the user cannot override FPRPC blocking in Trust Center. A value of 0 permits continued use of FPRPC.
Notes
Security
FPRPC is an outdated protocol originally used to access and author content on web servers. Microsoft states that attackers can exploit the protocol through specially crafted files or network traffic to execute arbitrary commands or compromise a system. Blocking FPRPC fallback reduces this attack surface and favors access over HTTPS.
This setting does not generally block HTTP, FTP, or other protocols. Separate Office policies control those protocols.
Possible side effects
Files hosted on legacy servers or applications that are accessible only through FPRPC might no longer open. This can occur when HTTPS is unavailable or is incompatible with the target system.
Notes
Microsoft documents FPRPC file-open blocking as the default behavior in Microsoft 365 apps for Windows beginning with version 2508. When the policy value is absent, the effective behavior can therefore depend on the installed Office version and the user's Trust Center preference. For current Microsoft 365 apps, an absent value is not necessarily equivalent to 0.
“Microsoft Office 2016” in the category path reflects the organization of the Office administrative templates. Microsoft's current documentation describes the feature and its default behavior for Microsoft 365 apps.
Microsoft documentation
Microsoft Learn: Block FrontPage Server Extensions Remote Procedure Call (FPRPC) for file opens
Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference