Untrusted Font Blocking

This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.

Supported on: At least Windows 10 Server, Windows 10 or Windows 10 RT
Mitigation Options


  1. Block untrusted fonts and log events
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
    Value NameMitigationOptions_FontBocking
    Value TypeREG_SZ
    Value1000000000000
  2. Do not block untrusted fonts
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
    Value NameMitigationOptions_FontBocking
    Value TypeREG_SZ
    Value2000000000000
  3. Log events without blocking untrusted fonts
    Registry HiveHKEY_LOCAL_MACHINE
    Registry PathSOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
    Value NameMitigationOptions_FontBocking
    Value TypeREG_SZ
    Value3000000000000


grouppolicy.admx

Administrative Templates (Computers)

Administrative Templates (Users)