Scripted Window Security Restrictions

Purpose

Show registry keys (14)

• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\groove.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\excel.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\mspub.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\powerpnt.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\pptview.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\visio.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\winproj.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\winword.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\outlook.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\spdesign.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\exprwd.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\msaccess.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\onenote.exe
• HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_window_restrictions\mse7.exe

)

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

The feature constrains windows opened or manipulated by script through the Internet Explorer or WebBrowser Control infrastructure. Affected windows are kept within the viewable desktop area. The size and position of pop-up windows without normal window chrome are also restricted, and certain windows are required to display a status bar. These constraints prevent such windows from completely covering important information in their parent windows or in system dialog boxes.

The setting does not generally disable scripts or block every pop-up window. It specifically limits how scripted windows can be displayed and positioned in the selected processes.

Notes

Security

The restrictions make it harder for web content or other script code running through the affected browser component to present deceptive windows. In particular, scripts cannot conceal a window's identity by hiding its title or status bar or use specially positioned windows to obscure security-relevant content in another window or system dialog box.

Protection applies only to processes with an enabled value and only to functionality that observes this Internet Explorer feature control. The policy is therefore not a general defense against malicious scripts, macros, or other active content in Office.

Possible side effects

Legacy or specialized Office solutions that embed web content through the Internet Explorer WebBrowser Control might no longer be able to display windows at their intended size or position. Pop-up windows without standard window chrome can be resized, repositioned, or made to include a status bar.

Notes

Each executable name is an independent registry value. Enabling the restriction for one process does not automatically enable it for the other listed applications.

This is a process-specific Internet Explorer feature-control setting. It is distinct from similarly named security-zone policies that can allow unconstrained script-initiated windows for particular Internet security zones.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – Scripted Window Security Restrictions

Microsoft Learn: INTERNETFEATURELIST enumeration – FEATURE_WINDOW_RESTRICTIONS

See also

• Entry in the reference