Windows Script Host Registry Key Settings

This article explains how to control the execution policy of Windows Script Host (WSH) scripts using the Windows Registry. By modifying specific registry keys, administrators can globally or individually enable, disable, or restrict the execution of VBScript (.vbs) and JScript (.js) files across a Windows system.

Primary Registry Keys for WSH Execution

Windows Script Host uses the Enabled DWORD value inside the Settings key to determine whether scripts are allowed to execute. Depending on whether you want to apply the rule system-wide or per-user, the configuration is stored in one of two locations:

• Machine-Wide (All Users):
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings

• Current User Only:
  HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings

Controlling Script Execution

To enable or disable WSH, configure the Enabled value inside the target key:

• Value Name: Enabled
• Value Type: REG_DWORD
• Value Data:
  • 1 = Enabled (WSH scripts are permitted to run)
  • 0 = Disabled (WSH scripts are blocked from running)

When set to 0, attempting to run a .vbs or .js file displays the error: “Windows Script Host access is disabled on this machine. Contact your administrator for details.”

How to Configure the Setting in Regedit

1. Press Win + R, type regedit, and press Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings (If the Settings key does not exist, right-click Windows Script Host, select New > Key, and name it Settings).
3. In the right pane, double-click the Enabled value (or create a new DWORD (32-bit) Value named Enabled).
4. Set the Value data to 0 to block script execution or 1 to allow it.
5. Click OK and close the Registry Editor. Changes take effect immediately without requiring a system reboot.

Advanced: TrustPolicy Key

In enterprise environments using digital signatures for scripts, WSH also supports the TrustPolicy DWORD value under the same Settings key:

• 0 = Run all scripts without checking signatures.
• 1 = Prompt the user if a script is untrusted or unsigned.
• 2 = Block any script that is untrusted or unsigned.