Block loading of COM/VSTO add-ins registered in HKCU

Supported OS tags: Windows10

This policy setting controls whether COM/VSTO add-ins registered only in HKEY_CURRENT_USER (HKCU) are blocked from loading. Standard users can install add-ins through ClickOnce deployment or the Office Add-ins settings, which typically register add-ins in HKCU rather than HKEY_LOCAL_MACHINE (HKLM). If you enable this policy setting, all COM/VSTO add-ins registered only in HKCU will be blocked from loading, preventing users from running add-ins they have installed without administrator privileges. If you disable or don't configure this policy setting, COM/VSTO add-ins registered in HKCU are allowed to load normally. Note: Add-ins registered in HKLM (typically installed by administrators) are not affected by this policy setting.

This policy has no additional user input fields.

• User
  ActiveX Control Initialization

  Windows7
• User
  Allow Basic Authentication prompts from network proxies

  Windows7
• User
  Allow file extensions for OLE embedding

  Windows7
• User
  Allow root or intermediate certificates as VBA trusted publishers

  Windows 10
• User
  Allow specified hosts to show Basic Authentication prompts to Office apps

  Windows7
• User
  Allow VBA to load typelib references by path from untrusted intranet locations

  Windows 10
• User
  Automation Security

  Windows7
• User
  Block additional file extensions for OLE embedding

  Windows7
• User
  Block all internet macros (ignore trusted locations or publishers)

  Windows 10
• User
  Block Insecure Protocols

  Windows7
• User
  Block OLE Graph

  Windows7
• User
  Block OrgChart

  Windows7