Microsoft.Policies.GroupPolicy• Machine

Untrusted Font Blocking

This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.

Policy Details

Policy Name: FontMitigation
Registry Key: SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
Supported On: At least Windows Server 2016, Windows 10
OMA-URI (CSP): ADMX_GroupPolicy/FontMitigation

OS Build Version:10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202
CSP Version:10.0
Conflict Resolution:LastWrite

Allowed Editions:
EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationHolographic BusinessPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
Available Languages: en-us

Configuration Elements

Mitigation Options

Type: enum

Allowed Values

1000000000000 Block untrusted fonts and log events
2000000000000 Do not block untrusted fonts
3000000000000 Log events without blocking untrusted fonts