Disable user name and password

Purpose

Show registry keys (14)

• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\groove.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\excel.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\mspub.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\powerpnt.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\pptview.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\visio.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\winproj.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\winword.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\outlook.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\spdesign.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\exprwd.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\msaccess.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\onenote.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_http_username_password_disable\mse7.exe

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

The restriction specifically covers URL syntax such as http(s)://username:password@server/. Such a URL is treated as invalid or as a security problem. The setting does not disable HTTP authentication in general, authentication prompts, modern authentication, or sign-in to Office services.

Notes

Security

The restriction helps prevent deceptive links in which text before the @ character resembles a trusted server name while the actual destination host appears after the @. For the selected processes, it also prevents credentials from being submitted to a server through this URL syntax.

Protection is applied per executable. It covers only processes with a matching enabled value under the feature-control key and does not replace other safeguards for hyperlinks, credentials, or web content.

Possible side effects

Legacy applications or web resources that legitimately expect a user name and password to be embedded directly in an HTTP or HTTPS URL cannot be reached through that URL from the affected Office applications. Other authentication methods are not directly disabled by this particular restriction.

Notes

This setting is an Internet Explorer feature control. Its scope is therefore limited to legacy Internet Explorer/Trident and URLMON functionality used by Office processes; it is not a general policy for Office accounts or password prompts.

Microsoft continues to list the policy under Microsoft Office 2016 (Machine) > Security Settings > IE Security. Current Microsoft baseline documentation can identify the OneNote component as onent.exe rather than onenote.exe; the actual effect of an individual registry value depends on its name matching the executable process.

Microsoft documentation

Microsoft Learn: List of settings for the Microsoft 365 Apps for Enterprise security baseline in Intune

Microsoft Learn: INTERNETFEATURELIST enumeration

See also

• Entry in the reference