Allow only per user or approved shell extensions
This setting is designed to ensure that shell extensions can operate on a per-user basis. If you enable this setting, Windows is directed to only run those shell extensions that have either been approved by an administrator or that will not impact other users of the machine. A shell extension only runs if there is an entry in at least one of the following locations in registry. For shell extensions that have been approved by the administrator and are available to all users of the computer, there must be an entry at HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved. For shell extensions to run on a per-user basis, there must be an entry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved.
Policy Details
- Policy Name
- EnforceShellExtensionSecurity
- Registry Key
- Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- Value Name
- EnforceShellExtensionSecurity
- Supported On
- At least Windows 2000
- OMA-URI (CSP)
- ADMX_WindowsExplorer/EnforceShellExtensionSecurityOS Build Version:10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202CSP Version:10.0Conflict Resolution:LastWriteAllowed Editions:EnterpriseEnterprise NProfessionalProfessional NEnterprise EvaluationEnterprise N EvaluationEducationEducation NEnterprise SEnterprise S NEnterprise S EvaluationEnterprise S N EvaluationHolographic BusinessPro Single LanguagePro ChinaPro WorkstationPro Workstation NPro For EducationPro For Education NEnterprisegEnterprisegnServerrdshIotenterpriseIotenterprisesCloudeditionnCloudeditionIotenterpriseskIotenterpriseseval
- Available Languages
- en-us
Supported Values
Simple Enabled/Disabled toggle controlling whether the value exists under the configured registry key.