How to Disable Windows Script Host in Regedit

This article explains how to disable the Windows Script Host (WSH) execution engine for standard users using the Windows Registry Editor (regedit). Disabling WSH prevents the system from running .vbs, .js, and .wsf script files, which is an effective security measure to block script-based malware from executing in user environments.

Step 1: Open the Registry Editor

1. Press Win + R on the keyboard to open the Run dialog box.
2. Type regedit and press Enter.
3. If prompted by User Account Control (UAC), click Yes to proceed.

Step 2: Navigate to the Windows Script Host Key

Depending on whether you want to disable WSH only for the currently logged-in user or across the entire system (including all standard users), navigate to the corresponding path in the left sidebar:

• For the Current User (Standard User profile):

  HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings

• For All Users on the Machine:

  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings

Note: If the Settings key does not exist under Windows Script Host, right-click the Windows Script Host folder, select New > Key, and name it Settings.

Step 3: Create and Configure the “Enabled” Value

1. Click on the Settings key in the left pane to view its contents in the right pane.
2. Right-click any empty space in the right pane, select New, and choose DWORD (32-bit) Value.
3. Name the new value Enabled.
4. Double-click the newly created Enabled value.
5. In the Value data field, enter 0 (zero).
6. Ensure the Base is set to Hexadecimal, then click OK.

Step 4: Verify the Changes

1. Close the Registry Editor.
2. To test if the restriction is active, create a new text file on the desktop and rename it to test.vbs.
3. Double-click test.vbs.
4. Windows should display an error message stating: “Windows Script Host access is disabled on this machine. Contact your administrator for details.”

How to Re-enable Windows Script Host

To restore the ability to run scripts: 1. Open regedit and navigate back to the Settings key. 2. Change the Enabled DWORD value data to 1, or delete the Enabled value entirely.