Windows Defender Application Guard Registry Key Guide

Windows Defender Application Guard (WDAG) provides hardware-level virtualization to isolate untrusted websites and MS Office files inside a secure Hyper-V container. System administrators can directly configure, customize, and manage the policies governing this sandboxing environment through specific keys in the Windows Registry (Regedit).

The primary registry key responsible for managing the behavior of Windows Defender Application Guard is:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\AppHVSI

Under this key, AppHVSI (Application Hyper-V Security Isolation) stores policy values that define how the isolated container interacts with the host operating system. If configured via Group Policy or Mobile Device Management (MDM), the settings automatically populate in this location.

Key Registry Values in AppHVSI

Administrators can configure several DWORD (32-bit) values within the AppHVSI key to alter container permissions:

• AllowAppHVSI_ProviderSet: Enables or disables Application Guard for Edge or Microsoft Office (Value 1 enables containerization).
• AppHVSIClipboardSettings: Manages copy-and-paste behavior between the host and the container (0 blocks all clipboard sharing, 1 allows host-to-container, 2 allows container-to-host, and 3 enables bidirectional sharing).
• AppHVSIPrintingSettings: Controls printing capabilities from within the sandboxed environment (uses bitmask values to permit network, local, or PDF/XPS printing).
• AppHVSICamMicAccess: Governs whether the sandboxed browser can access the host microphone and webcam (0 disables access, 1 permits access).
• AllowPersistence: Determines if user data—such as favorites, cookies, and saved passwords—persists across sandbox sessions (0 creates a disposable container, 1 preserves data).

How to Access and Modify the Key

1. Press Win + R, type regedit, and press Enter to launch the Registry Editor.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft.
3. Locate or create the AppHVSI key.
4. Add or modify the required DWORD values to enforce the desired container security boundaries.
5. Restart the device or restart the WDAG service for the policy changes to take effect.