Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Office hardening

Every setting of the “Office hardening” package with its effect, value and recommending sources.

since 0.9.8.11

Purpose

This page lists every setting of the “Office hardening” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

287 settings.

Notes

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\msaccess.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\msaccess.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\powerpnt.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\pptview.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\winproj.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\spdesign.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\visio.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\winword.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Do not override Flash ActiveX activation blocking (Office, CLSID 6E)

This DWORD value controls an exception to the Office COM kill bit for the ActiveX control identified by Microsoft as Shockwave Flash Object, CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}.

Block Flash activation in Office documents

This machine-wide REG_DWORD value applies to the COM object that Microsoft identifies as “Macromedia Flash Factory Object,” with CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}.

Do not allow activation of Macromedia Flash Factory Object (Office 16.0)

The ActivationFilterOverride DWORD value controls an exception to the Office COM kill bit for Macromedia Flash Factory Object, identified by CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict ActiveX Install

This setting controls the Internet Explorer feature control FEATURE_RESTRICT_ACTIVEXINSTALL separately for each listed Microsoft Office process. A REG_DWORD value of 1 enables the restriction for the executable identified by that value name.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Restrict File Download

This machine-level Office policy controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature separately for each listed executable. The feature applies when one of these processes uses Internet Explorer's URL-security or browser-control infrastructure.

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\msaccess.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\excel.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\exprwd.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\mse7.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\onenote.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\outlook.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\pptview.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\powerpnt.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\winproj.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\mspub.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\spdesign.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\groove.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\visio.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Object Caching Protection

This setting controls the Internet Explorer feature control FEATURE_OBJECT_CACHING for each named Office application. The protection prevents web content processed by the application from accessing or instantiating cached ActiveX controls originating from a different domain or security context.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_object_caching\winword.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Object Caching Protection
  • Source: [Microsoft Learn: Internet Feature Controls – ActiveX Object Caching](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330729(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\excel.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\exprwd.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Do not allow Flash activation in Office (CLSID 6E, 16.0)

This DWORD value controls an exception to the Office COM activation filter for the ActiveX control identified by Microsoft as Shockwave Flash Object, CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}.

Block Flash activation in Office documents (CLSID 6E, Common)

The ActivationFilterOverride DWORD value controls an exception to the Office COM kill bit for the Shockwave Flash Object, identified by CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}.

Block Flash activation in Office documents (CLSID 70, 16.0)

The ActivationFilterOverride DWORD value controls an exception to Office activation blocking for the Macromedia Flash Factory Object, identified by CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}.

Do not allow Flash activation in Office (CLSID 70, Common)

This DWORD value applies to the Macromedia Flash Factory Object, identified by CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}. Microsoft Office includes this COM object among the controls that are blocked from activation by default.

Office COM kill bit for Shockwave Flash Object

Setting the Compatibility Flags DWORD to 1024 (hexadecimal 0x00000400) applies the Office COM kill bit to the Shockwave Flash Object COM class identified by CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}. Office consequently prevents this Flash ActiveX control from being activated.

Block the Macromedia Flash Factory Object in Office 16.0

Setting the Compatibility Flags DWORD to 1024 (0x00000400) applies the Office COM kill bit to the COM object whose CLSID is {D27CDB70-AE6D-11CF-96B8-444553540000}. Microsoft identifies this object as the Macromedia Flash Factory Object.

Disable the Flash ActiveX control using the Office kill bit

The Compatibility Flags value is a REG_DWORD. Setting its data to 1024 (0x00000400) prevents Microsoft Office from activating the COM object identified by CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}. Microsoft identifies this ActiveX control as Shockwave Flash Object.

Office COM kill bit for Macromedia Flash Factory Object

Setting the Compatibility Flags DWORD to 1024 (0x00000400) applies the Office COM kill bit to CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}. Microsoft identifies this COM class as Macromedia Flash Factory Object.

Block Flash activation in Office documents

The ActivationFilterOverride DWORD controls an exception to the Microsoft Office COM activation filter. Under CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}, it applies to the Shockwave Flash Object ActiveX control.

Disable Adobe Flash Player in Office (CLSID 6E, 16.0)

The DWORD value 1024, equivalent to 0x00000400, sets the Office COM kill bit for the COM object identified by CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}. This CLSID identifies the Adobe Flash Player ActiveX control named “Shockwave Flash Object.”

Office COM kill bit for Shockwave Flash Object

The Compatibility Flags DWORD value set to 1024 (0x00000400) applies the Office COM kill bit to CLSID {D27CDB6E-AE6D-11CF-96B8-444553540000}. This CLSID identifies the Shockwave Flash Object ActiveX control.

Block Flash control with the Office COM kill bit (CLSID 70, 16.0)

The Compatibility Flags DWORD with value data 1024 (0x00000400) sets the Office COM kill bit for CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}. Microsoft identifies the associated ActiveX control as Macromedia Flash Factory Object.

Office COM kill bit for Macromedia Flash Factory Object

The Compatibility Flags value is a DWORD. Setting its data to 1024 (hexadecimal 0x00000400) applies the Office COM kill bit to CLSID {D27CDB70-AE6D-11CF-96B8-444553540000}, which Microsoft identifies as Macromedia Flash Factory Object.

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\mse7.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\msaccess.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\excel.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\onenote.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\outlook.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\mspub.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\groove.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Add-on Management

This setting controls the Internet Explorer FEATURE_ADDON_MANAGEMENT feature separately for the listed executable files. It applies when one of these applications processes web content through the Internet Explorer WebBrowser Control.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_addon_management\exprwd.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Add-on Management
  • Source: [Microsoft Learn: Internet Feature Controls (U..Y) – WebOC Addon Management](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/general-info/ee330736(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Mime Sniffing Safety Feature

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_SNIFFING feature separately for each listed executable. It applies when one of those processes handles web-based content through the legacy Internet Explorer and URLMON platform components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\mse7.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\mse7.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\onenote.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\onenote.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\outlook.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\outlook.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Disable user name and password

This machine-level Office policy controls the Internet Explorer feature named FEATURE_HTTP_USERNAME_PASSWORD_DISABLE separately for each listed executable. An enabled REG_DWORD value with data 1 prevents the corresponding application from opening HTTP or HTTPS URLs containing embedded user information through the affected Internet Explorer or URLMON components.

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\pptview.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\pptview.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\powerpnt.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\powerpnt.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\winproj.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\winproj.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\mspub.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\mspub.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\spdesign.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\spdesign.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\groove.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\groove.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Information Bar

These application-specific registry values control the Internet Explorer FEATURE_SECURITYBAND feature for each named executable. The feature displays the Internet Explorer Information Bar when a file download or code installation has been restricted by another security setting.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\visio.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\visio.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Saved from URL

This setting controls the process-specific Internet Explorer feature control FEATURE_UNC_SAVEDFILECHECK for the listed Office applications. Each application name is represented by a separate REG_DWORD value. A value of 1 enables the check for that process.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_unc_savedfilecheck\winword.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Saved from URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Scripted Window Security Restrictions

This machine-level Office policy controls the Internet Explorer FEATURE_WINDOW_RESTRICTIONS feature separately for the listed executables. A value of 1, stored as REG_DWORD, enables the feature for the process identified by that value name.

Navigate URL

This setting controls the Internet Explorer FEATURE_VALIDATE_NAVIGATE_URL feature control separately for the listed Office executables. When enabled for a process, the Internet Explorer navigation component blocks navigation to pages whose URLs are malformed.

  • Technical:
    • Registry value: HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\main\featurecontrol\feature_validate_navigate_url\winword.exe = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • In detail: Navigate URL
  • Source: [Microsoft Learn: INTERNETFEATURELIST enumeration](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/platform-apis/ms537169(v=vs.85)
  • Recommended by: Microsoft 365 Apps for Enterprise 2512

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

Allow Active X One Off Forms

This REG_DWORD value determines which ActiveX controls classic Outlook for Windows may load in one-off forms. A one-off form stores its form definition in the individual Outlook item instead of referring to a published form.

Block macros from running in Office files from the internet

This per-user policy value controls whether PowerPoint can run VBA macros in files that Windows identifies as originating from the internet or another untrusted zone. Windows commonly records that origin by applying Mark of the Web (MOTW), for example to browser downloads and email attachments.

Always open untrusted database files in Protected View

This per-user Excel policy determines whether database files in .dbf format are always opened in Protected View when they originate from an untrusted location.

Always prevent untrusted Microsoft Query files from opening

This user policy determines whether Excel opens Microsoft Query files from untrusted locations. It covers .iqy, .oqy, .dqy, and .rqy files. These files can define connections to external data sources, import data into a worksheet, and refresh that data later.

Block OLE Graph

This user-scoped Office policy prevents the legacy Object Linking and Embedding (OLE) Graph functionality from running in Microsoft 365 Apps. It specifically covers OLE components such as MSGraph.Application and MSGraph.Chart.

Block OrgChart

This per-user registry value controls whether the legacy Organization Chart (OrgChart) Add-in for Microsoft Office programs can run. It is a REG_DWORD value: 1 blocks the add-in in Office applications that support the policy. Embedded OrgChart objects are not loaded as active objects; Office renders a static image instead.

Prevent users from customizing attachment security settings

This per-user policy value prevents users from overriding the set of attachment types blocked by Outlook through their own attachment security settings. When the policy is enabled, it is represented by the disallowattachmentcustomization value of type REG_DWORD with data 1.

Protect document metadata for rights managed Office Open XML Files

This user-scoped policy setting controls whether Word, Excel, and PowerPoint encrypt metadata in Office Open XML files protected by Information Rights Management (IRM).

Disable the Office client from polling the SharePoint Server for published links

This per-user registry value controls whether Office applications poll an Office or SharePoint server for published links.

Load pictures from Web pages not created in Excel

This per-user registry value controls whether Excel loads pictures when it opens or imports a Web page that was not created in Excel.

Disable AutoRepublish

This per-user Excel policy controls the AutoRepublish feature. AutoRepublish can write previously published workbook content to a static Web page again whenever the workbook is saved.

Configure Outlook object model prompt when responding to meeting and task requests

This REG_DWORD value controls the Outlook Object Model Guard when an untrusted program uses the Outlook object model's Respond method to respond to a meeting request or task request. It applies to programmatically creating or sending such responses, not to responses initiated manually by the user.

ActiveX Control Initialization

This user-scoped policy value controls how Office applications initialize ActiveX controls. Its behavior depends on whether a control is marked Safe for Initialization (SFI) or Unsafe for Initialization (UFI), whether the control is initialized in safe mode, and whether persisted values stored in the document are used.

Turn off file validation

This per-user registry value controls Office File Validation in PowerPoint. File validation examines legacy PowerPoint binary files before they are opened and checks their internal structure against the rules of the expected file format. The affected formats include PowerPoint 97–2003 presentations, shows, and templates, such as files with .ppt, .pps, and .pot extensions.

Turn off file validation

This REG_DWORD value controls Office File Validation when Excel opens files. File validation compares the structure of Office 97–2003 binary documents with the expected file-format schema before Excel opens them.

Set document behavior if file validation fails

This user policy controls how Excel 2016 and other Excel releases in the Office 16.0 product family handle workbooks that fail Office File Validation. File Validation examines the structure of supported files for irregularities that might indicate corrupted or potentially harmful content.

Block Excel XLL Add-ins that come from an untrusted source

This per-user Excel policy controls whether XLL add-ins from untrusted sources can run. XLL files contain executable add-in code and can extend Excel with custom functions and other capabilities.

Display Level 1 attachments

This per-user REG_DWORD value controls whether attachments whose file types are classified as Level 1 are accessible in classic Outlook. Outlook assigns potentially dangerous file types to Level 1 and normally blocks access to them completely.

Remove file extensions blocked as Level 2

This string value (REG_SZ) identifies file name extensions that Outlook removes from the Level 2 attachment list. Multiple extensions are separated by semicolons within the value.

Allow hyperlinks in suspected phishing e-mail messages

This per-user registry value controls whether Outlook makes hyperlinks usable in messages identified as suspected phishing but not also classified as junk e-mail.

Automation Security

This per-user registry value controls how Excel, PowerPoint, and Word handle macros when another application starts the Office application programmatically. It is a REG_DWORD value whose data corresponds to the Office MsoAutomationSecurity enumeration:

Macro Runtime Scan Scope

This value determines which macro-enabled files Office submits for runtime inspection through the Antimalware Scan Interface (AMSI). It applies to VBA macros in supported Office applications and to Excel 4.0 (XLM) macros, which are supported only by Excel.

Block macros from running in Office files from the internet

This per-user policy value controls whether Microsoft Access can run macros in Office files that Windows identifies as originating from the internet or another untrusted zone. That origin is commonly represented by Mark of the Web (MOTW), for example on downloaded files and email attachments.

Block macros from running in Office files from the internet

This per-user Excel policy blocks VBA macros in files that Windows or Office identifies as originating from the internet. Typical examples include downloaded files and email attachments carrying Mark of the Web (MOTW). Files on network shares can also be affected when the location is classified in the Internet zone and is not recognized as trusted.

Security setting for macros

This per-user policy value selects the security level applied to VBA macros in classic Outlook for Windows. It is a REG_DWORD value with the following supported settings:

Minimum encryption settings

The minenckey value defines the minimum encryption-key length against which Outlook evaluates encrypted e-mail messages for the current user. It is a REG_DWORD; its data represents the key length in bits.

Allow Trusted Locations on the network

This per-user registry value controls whether Microsoft Access can use network paths as Trusted Locations. Its type is REG_DWORD.

Allow Trusted Locations on the network

This per-user Excel policy setting controls whether network locations can be used as Trusted Locations. When the policy is enabled, Excel recognizes network locations that have been designated as trusted. The setting does not designate a path by itself; Trusted Location paths must be defined separately.

Allow users to demote attachments to Level 2

This per-user policy value controls whether users of classic Outlook may reclassify attachment file types from Level 1 to Level 2.

Outlook Security Mode

The adminsecuritymode REG_DWORD value selects the source from which classic Outlook obtains administrative security settings for the current user. It does not itself contain individual rules for attachments, add-ins, custom forms, or access through the Outlook object model.

Allow Trusted Locations on the network

This per-user registry value controls whether PowerPoint can use network locations as Trusted Locations.

Run Programs

This per-user policy value controls whether PowerPoint can launch external programs through the Run Program action. This action can be assigned to an object or action button in a presentation and invoked by the user during a slide show.

Block macros from running in Office files from the internet

This per-user policy setting controls whether Microsoft Project can run VBA macros in files that Windows or Office identifies as originating from the internet. This primarily includes files carrying Mark of the Web (MOTW), such as browser downloads and email attachments. Files opened from network shares can also be affected when the location is assigned to the Internet zone and is not considered trusted.

Allow Trusted Locations on the network

This per-user policy setting controls whether Microsoft Project can use Trusted Locations hosted on network shares or other remote locations.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Publisher Automation Security Level

This per-user policy value determines how Microsoft Publisher handles macros in publications opened programmatically by another application. It is a REG_DWORD corresponding to the automation security mode used by Publisher:

Block macros from running in Office files from the internet

This per-user registry value controls whether Microsoft Publisher blocks macros in files obtained from untrusted internet sources. The Office Administrative Templates define it as a REG_DWORD: 1 enables the block, while 0 disables this policy-enforced block.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Restrict Apps from FPRPC Fallback

This per-user registry value controls whether Microsoft 365 apps may fall back to the legacy FrontPage Server Extensions Remote Procedure Call (FPRPC) protocol when opening files.

Disable all Trust Bar notifications for security issues

This user-scoped Office policy controls whether the Message Bar reports potentially unsafe features or content that Office has detected or automatically blocked. Examples include macros, ActiveX controls, add-ins, and external data connections.

Allow scripts in one-off Outlook forms

This user-scoped Outlook policy controls whether scripts may run in one-off Outlook forms. A one-off form stores its form definition—including its layout and any VBScript code—inside an individual Outlook item. The item therefore does not rely solely on a separately published form in a forms library.

Disable Smart Document's use of manifests

This user-scoped policy controls whether Word and Excel can load XML expansion pack manifest files for Smart Documents.

Encryption type for password protected Office 97-2003 files

This policy-backed registry value specifies the cryptographic provider, encryption algorithm, and key length that Excel, PowerPoint, and Word use when encrypting password-protected files in the binary Office 97-2003 formats.

Allow Basic Authentication prompts from network proxies

This per-user policy controls whether Office applications accept sign-in prompts when a network proxy requests Basic Authentication.

Disable additional security checks on VBA library references that may refer to unsafe locations on the local machine

This per-user registry value controls additional path checks for library references in VBA projects. References to type libraries (*.olb, *.tlb, *.dll), executable files (*.exe), and ActiveX controls (*.ocx) can be affected.

Allow VBA to load typelib references by path from untrusted intranet locations

This per-user Office policy controls whether Visual Basic for Applications can load type libraries and other project references through a path stored in the VBA project when that path points to an untrusted intranet location.

Scan encrypted macros in PowerPoint Open XML presentations

This REG_DWORD value controls whether encrypted VBA macros in PowerPoint Open XML presentations must be scanned by antivirus software before they are loaded.

Enable RPC encryption

This per-user policy value controls RPC encryption for communication between Outlook 2016 and Microsoft Exchange. It is a REG_DWORD value. A value of 1 makes Outlook use RPC security encryption for applicable Exchange connections and enforces the setting independently of the corresponding Outlook profile option.

Scan encrypted macros in Excel Open XML workbooks

This per-user REG_DWORD value controls whether Excel submits encrypted VBA macros in encrypted or rights-protected Open XML workbooks to compatible antivirus software before loading them.

Block macros from running in Office files from the internet

This per-user policy value controls whether Microsoft Visio can run VBA macros in files that Windows or Office identifies as originating from the internet. When blocking is enforced, Visio does not execute the affected macros. A less restrictive Trust Center setting, including the general option to enable all macros, does not override the policy.

Allow Trusted Locations on the network

This per-user REG_DWORD value controls whether Microsoft Visio can use Trusted Locations on a network. It does not define a Trusted Location itself; it determines whether Visio accepts network paths that have been designated as trusted.

Remove file extensions blocked as Level 1

This string value (REG_SZ) specifies the file name extensions that classic Outlook no longer treats as Level 1 attachments. Multiple extensions are represented as a semicolon-separated list.

Signature Warning

This registry value controls how Outlook warns users when they open an email message that has an invalid digital signature. It is a per-user policy value of type REG_DWORD.

Do not show AutoRepublish warning alert

This user policy controls whether Excel displays an alert before automatically republishing a workbook.

Disable UI extending from documents and templates

This user-scoped Office policy controls, separately for each listed application, whether the application loads user-interface customizations embedded in a document or template. Such customizations can provide additional Ribbon tabs, groups, buttons, or commands.

Set document behavior if file validation fails

This user policy controls how Microsoft Word handles a document that fails Office File Validation. File Validation checks the structure of supported file formats for irregularities that can result from file corruption or deliberately manipulated content. For Word, Microsoft specifically identifies the legacy Word 97–2003 .doc and .dot formats as formats that can produce file-validation errors.

Turn off file validation

This per-user REG_DWORD value controls Office File Validation in Microsoft Word. Before Word opens a binary Word 97–2003 document, particularly a .doc or .dot file, file validation can compare the document’s internal structure with the rules defined for that file format.

Block macros from running in Office files from the internet

This per-user policy value controls whether Microsoft Word blocks VBA macros in files identified as originating from the internet. Such files commonly include browser downloads and email attachments carrying Mark of the Web (MOTW). Files opened from a network share can also be affected when Windows classifies the location in the Internet zone rather than as Local intranet or a Trusted site.

Allow Trusted Locations on the network

This per-user Word policy controls whether network paths can function as Trusted Locations. When the policy is enabled, Word can recognize network locations defined either by policy or by the user as trusted.

Scan encrypted macros in Word Open XML documents

This per-user registry value determines whether Word requires encrypted VBA macros in Word Open XML documents to be scanned by antivirus software before they are loaded. It is a REG_DWORD value with the following supported data:

Retrieving CRLs (Certificate Revocation Lists)

The usecrlchasing value controls how Outlook retrieves Certificate Revocation Lists (CRLs) when checking the validity of a certificate. A CRL identifies certificates that the issuing certification authority has revoked before their scheduled expiration.

Configure Outlook object model prompt When accessing the Formula property of a UserProperty object

This REG_DWORD value controls how the Object Model Guard in classic Outlook responds when untrusted code accesses the protected Formula property of a UserProperty object. The property contains the formula associated with a custom Outlook property and can be used by combination or formula fields in custom forms. Because such formulas can reference address-information fields, Outlook treats access to this property as security-sensitive.

blockcontentexecutionfrominternet

Description to follow.

  • Technical:
    • Registry value: HKEY_CURRENT_USER\...\Security\blockcontentexecutionfrominternet = 1 (REG_DWORD)
  • Switch in the app: Policies › Office hardening
  • Recommended by: Setup Foundry

Set document behavior if file validation fails

This user-scoped PowerPoint policy controls what happens to presentations that fail Office File Validation. File validation examines supported legacy PowerPoint formats for structural deviations from the expected file format. A validation failure can indicate a deliberately malformed file, but it can also result from corruption or a defect in another application.

Set document behavior if file validation fails

This user-scoped PowerPoint policy controls what happens to presentations that fail Office File Validation. File validation examines supported legacy PowerPoint formats for structural deviations from the expected file format. A validation failure can indicate a deliberately malformed file, but it can also result from corruption or a defect in another application.

Turn off Protected View for attachments opened from Outlook

This user-scoped policy value determines whether Excel workbooks opened as Outlook attachments are opened in Protected View.

Do not open files in unsafe locations in Protected View

This per-user Excel policy value controls whether files opened from locations classified as unsafe bypass Protected View. Its data type is REG_DWORD.

Turn off Protected View for attachments opened from Outlook

This per-user policy value determines whether PowerPoint files opened as Outlook attachments start in Protected View.

Do not open files from the Internet zone in Protected View

This per-user REG_DWORD value controls whether Excel opens files from the Internet zone in Protected View.

Require that application add-ins are signed by Trusted Publisher

This per-user registry policy value determines whether PowerPoint verifies an application add-in’s digital signature before loading it. It is a REG_DWORD value: 1 enforces the signature requirement, while 0 disables that policy requirement.

Do not open files from the internet zone in Protected View

This per-user policy value determines whether PowerPoint opens files associated with the Windows Internet zone in Protected View.

Do not open files in unsafe locations in Protected View

This per-user REG_DWORD value determines whether PowerPoint opens files from locations classified as unsafe in Protected View.

Configure Outlook object model prompt when accessing an address book

This per-user REG_DWORD value controls how Outlook responds when an untrusted program accesses an address book through the Outlook object model. It applies to address-book entry points protected by the Outlook Object Model Guard.

Configure Outlook object model prompt when reading address information

This per-user REG_DWORD value controls how the Object Model Guard in classic Outlook handles programmatic requests to read protected address information through the Outlook object model. Protected information includes sender, recipient, and email address data exposed through certain object-model properties and methods.

Set Outlook object model custom actions execution prompt

This REG_DWORD value determines how classic Outlook for Windows responds when a custom action is executed through the Outlook object model. Custom actions extend Outlook functionality and can, for example, be triggered by a rule.

Configure Outlook object model prompt when sending mail

This per-user REG_DWORD value controls how the Outlook Object Model Guard in classic Outlook responds when an untrusted program attempts to send an item programmatically.

Configure Outlook object model prompt when executing Save As

This registry value controls how the Outlook object model responds when an untrusted program uses a protected SaveAs method to save an Outlook item to a file outside Outlook. It governs programmatic access and does not control an interactive Save As operation initiated by the user.

Require that application add-ins are signed by Trusted Publisher

This per-user registry value controls signature verification for application add-ins in Microsoft Project. It is a REG_DWORD value. When set to 1, Project checks an add-in's digital signature before loading it. Project disables the add-in if it is unsigned or if its signature does not come from a trusted publisher.

Require that application add-ins are signed by Trusted Publisher

This per-user policy determines whether Microsoft Publisher verifies an application add-in’s digital signature before loading the add-in.

Require that application add-ins are signed by Trusted Publisher

This per-user policy value determines whether Excel verifies an application add-in's digital signature before loading the add-in.

Block Insecure Protocols

This registry value controls which network protocols supported Microsoft 365 apps for Windows can use when opening documents. Its data type is REG_DWORD.

Require that application add-ins are signed by Trusted Publisher

This per-user Visio policy requires application add-ins to carry a valid digital signature from a publisher recognized as trusted before they can be loaded. The relevant code-signing certificate must be present in the Windows Trusted Publishers certificate store.

WEBSERVICE Function Notification Settings

This per-user registry value controls whether Excel runs worksheet formulas containing the WEBSERVICE function and whether it displays a security warning. WEBSERVICE issues an HTTP GET request to the Internet or intranet URL supplied by the formula and returns the web service response to the workbook.

Require that application add-ins are signed by Trusted Publisher

This per-user policy value determines whether Microsoft Word verifies an application add-in’s digital signature before loading the add-in.

Do not open files from the internet zone in Protected View

This per-user REG_DWORD value determines whether Microsoft Word opens files from the Internet zone in Protected View. The decision is based on zone information supplied by Windows, such as the origin marking attached to a downloaded file.

Turn off Protected View for attachments opened from Outlook

This per-user policy setting determines whether Word files opened as Outlook attachments initially open in Protected View.

Do not open files in unsafe locations in Protected View

This per-user policy value controls whether Microsoft Word opens files from locations classified as unsafe in Protected View. Despite the policy name, it does not prevent Word from opening those files.

See also