Application Guard File Download Registry Key

This article explains how to configure the Windows Defender Application Guard (WDAG) file download boundary settings using the Windows Registry. By navigating to the designated policy key and modifying the relevant DWORD value, administrators can control whether files downloaded within an isolated Application Guard container can be saved directly onto the host operating system.

The WDAG File Download Registry Key

The registry key that manages Application Guard policies, including file download boundaries and host interactions, is located at:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppHVSI

Within this key, the specific value controlling the file download boundary is SaveFilesToHost.

Value Data Configurations

• Value Name: SaveFilesToHost
• Type: REG_DWORD
• Values:
  • 0: Blocked (Default) – Users cannot save downloaded files from the Application Guard session to the host file system.
  • 1: Allowed – Users are permitted to download and save files directly to the host operating system from within the isolated Application Guard browsing session.

How to Configure via Regedit

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
2. Navigate to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
3. Check if the AppHVSI key exists. If it does not, right-click the Microsoft folder, select New > Key, and name it AppHVSI.
4. Select AppHVSI, right-click inside the right-hand pane, and select New > DWORD (32-bit) Value.
5. Name the new value SaveFilesToHost.
6. Double-click SaveFilesToHost, set the Value data to 1 (to allow downloads to host) or 0 (to restrict them), and click OK.
7. Restart the computer or restart the Windows Defender Application Guard service for the changes to take effect.