Restrict File Download

Purpose

Show registry keys (14)

• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\groove.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\excel.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\mspub.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\powerpnt.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\pptview.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\visio.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\winproj.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\winword.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\outlook.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\spdesign.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\exprwd.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\msaccess.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\onenote.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_restrict_filedownload\mse7.exe

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Each value is a REG_DWORD associated with the process having the corresponding file name. A value of 1 enables the restriction for that process; 0 disables it. When the restriction is enabled, file-download prompts that were not explicitly initiated by a user action, such as a mouse click or key press, are blocked. Downloads deliberately initiated by the user are generally unaffected.

This setting is not a general network or download prohibition for Office. It affects only download activity handled by FEATURE_RESTRICT_FILEDOWNLOAD within the named processes.

Notes

Security

The restriction reduces the ability of web content to produce download prompts without prior user interaction. In particular, it helps limit repeated or misleading prompts intended to persuade users to download potentially harmful files.

The feature does not inspect file contents or prevent a download that the user explicitly initiates. It therefore does not replace malware scanning, file-type or content controls, or other protections for downloaded files.

Possible side effects

Web-based Office features, add-ins, or older embedded web applications can be affected if they depend on opening a download prompt without an immediate user action. Downloads explicitly initiated by the user are not subject to this restriction.

Notes

Because these values reside under HKLM, they apply to the entire computer. Each process name is evaluated independently; configuring the value for one application does not extend the restriction to other applications or arbitrary child processes.

The setting uses the legacy Internet Explorer Feature Control infrastructure. It has an effect only when the relevant process actually uses that infrastructure for the download operation.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – Restrict File Download

Microsoft Learn: INTERNETFEATURELIST enumeration – FEATURE_RESTRICT_FILEDOWNLOAD

Microsoft Download Center: Administrative Template files for Microsoft Office

See also

• Entry in the reference