Application Guard Master Settings Registry Key

This article provides a direct overview of the Windows Registry key that controls the master configuration and policies for Windows Defender Application Guard (WDAG). You will find the exact path within the Registry Editor (Regedit), the difference between the policy and operational keys, and the key values commonly configured for hardware-isolated environments.

The Master Registry Key for Application Guard

The master policy settings for Windows Defender Application Guard are stored in the Windows Registry under the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppHVSI

(Note: HVSI stands for Host-isolated Virtualization Security Infrastructure.)

If you are inspecting system runtime and installation states rather than Group Policy enforcement, WDAG also maintains operational settings at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HVSI

Common Value Names Under the AppHVSI Key

When configuring WDAG policies via Regedit, specific DWORD (32-bit) values are created or modified under the AppHVSI key to toggle security controls:

• AllowAppHVSI: Controls whether Application Guard is enabled for Microsoft Edge and supported apps (1 = Enabled, 0 = Disabled).
• AppHVSIClipboardSettings: Governs clipboard copy/paste actions between the host and the isolated container (0 = Block all, 1 = Host to container only, 2 = Container to host only, 3 = Both directions allowed).
• AppHVSIPrintingSettings: Restricts printing from within the container (0 = Block printing, 1 = Print to local printers, 2 = Print to network/shared printers, 4 = Print to PDF/XPS).
• AllowCameraMicrophoneRedirection: Controls access to local camera and microphone hardware inside the virtual container (0 = Blocked, 1 = Allowed).
• AppHVSIDataPersistence: Determines whether container browsing data (cookies, saved passwords, favorites) persists across sessions (0 = Discard on exit, 1 = Retain data).

How to Access and Modify the Key

1. Press Win + R, type regedit, and press Enter.
2. Navigate the left sidebar to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\
3. If the AppHVSI subkey does not exist, right-click the Microsoft folder, select New > Key, and name it AppHVSI.
4. Right-click in the right pane, select New > DWORD (32-bit) Value, name the value according to the desired policy (such as AllowAppHVSI), and set its value data.
5. Restart the computer for system-wide policy changes to take effect.