Block launching desktop apps associated with a URI scheme
Jump to overview

Policy overview

Key metadata and intent for this policy.

Category
Windows Components > App runtime
Supported on
At least Windows Server 2012, Windows 8 or Windows RT

Supported OS tags: Windows10, Windows10RT, Windows11, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2012, WindowsServer2012R2, WindowsServer2016

This policy setting lets you control whether packaged Microsoft Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than packaged Microsoft Store apps, there is a risk that a URI scheme launched by a packaged Microsoft Store app might compromise the system by launching a desktop app. If you enable this policy setting, packaged Microsoft Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other packaged Microsoft Store apps. If you disable or do not configure this policy setting, packaged Microsoft Store apps can open URIs in the default desktop app for a URI scheme. Note: Enabling this policy setting does not block packaged Microsoft Store apps from opening the default desktop app for the http, https, and mailto URI schemes. The handlers for these URI schemes are hardened against URI-based vulnerabilities from untrusted sources, reducing the associated risk.

Internal name
AppxRuntimeBlockProtocolElevation
Policy ID
51f6b5db9ad4
Elements
0

Registry values

How enabled and disabled states update the registry.

ScopeRegistry locationTypeEnabled valueDisabled valueCopy
Path
Software\Microsoft\Windows\CurrentVersion\Policies\Associations
Value name
BlockProtocolElevation
REG_DWORD
HKLM
1
HKCU
1
HKLM
0
HKCU
0
Registry location
Type REG_DWORD · Both
Path
Software\Microsoft\Windows\CurrentVersion\Policies\Associations
Value name
BlockProtocolElevation
Hive
HKLM
Enabled value
1
Disabled value
0
Hive
HKCU
Enabled value
1
Disabled value
0

Policy elements

Inputs and configuration options exposed by this policy.

This policy has no additional user input fields.