Allow file group descriptor operations to write to any destination path

Supported OS tags: Windows10, Windows10RT, Windows11, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2012, WindowsServer2012R2, WindowsServer2016

This policy setting determines whether path traversal containment checks are enforced when writing files received via clipboard or drag-drop file group descriptors (CFSTR_FILEDESCRIPTOR). If you enable this policy setting, path traversal containment checks are not enforced and files may be written to any path reachable by the destination folder. Enable this policy only if the default behavior breaks a required workflow. If you disable or do not configure this policy setting, file group descriptor operations enforce path containment and reject file names that attempt to escape the destination folder via relative path components.

This policy has no additional user input fields.

• User
  Allow only per user or approved shell extensions

  At least Windows 2000
• Computer
  Allow the use of remote paths in file shortcut icons

  At least Windows Server 2012, Windows 8 or Windows RT
• Computer
  Configure Windows Defender SmartScreen

  At least Windows Server 2012, Windows 8 or Windows RT
• ComputerUser
  Disable binding directly to IPropertySetStorage without intermediate layers.

  At least Windows Vista
• Computer
  Disable File Explorer feature to prelaunch a window in the background

  At least Windows 11 Version 22H2
• User
  Disable Known Folders

  At least Windows Server 2008 R2 or Windows 7
• User
  Display confirmation dialog when deleting files

  At least Windows Server 2003 operating systems or Windows XP Professional