Windows 11 Pro files.vbs

To answer your specific questions regarding the configuration in the screenshots:

1. Value Name: Yes, you must write a specific name in the Nome do valor field. The exact name required by the Windows system is Enabled (please note the 'd' at the end).
   • Do not use "Enable".
   • Do not check the "Predefinição" (Default) box. Checking that box targets the default key value, which the Windows Script Host does not check for restrictions.
   The Yellow Triangle: You can safely ignore the yellow triangle icon you see in the list view (Image 2). In the Group Policy Preferences console, that icon does not indicate an error. It simply represents the "Update" (Atualizar) action. Green triangle = Create

     Yellow triangle = Update
   
        Red circle = Replace/Delete
   

To ensure the policy works, your final configuration in the Propriedades window should look exactly like this:

Ação: Atualizar

Ramo de registo: HKEY_CURRENT_USER

Caminho da chave: SOFTWARE\Microsoft\Windows Script Host\Settings

Nome do valor: Enabled

Tipo do valor: REG_DWORD

Dados do valor: 0

Once you save this with the name Enabled and run gpupdate /force on the client machine, the restriction will take effect.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message.

VP

Good afternoon MadUrantia,

To reliably restrict .vbs files for specific users on Windows 11 Pro, the most robust "best practice" is to disable the Windows Script Host (WSH) engine specifically for those user profiles. This stops wscript.exe and cscript.exe from launching, rendering .vbs (and .js) files inert regardless of their location. Since you need to target specific users, you will implement this via Group Policy Preferences under the User Configuration context.

Open your Group Policy Management Console and edit the GPO linked to your target users. Navigate to User Configuration > Preferences > Windows Settings > Registry. Right-click in the right pane and select New > Registry Item. Set the Action to Update and the Hive to HKEY_CURRENT_USER. For the Key Path, enter Software\Microsoft\Windows Script Host\Settings. In the Value Name field, type Enabled. Set the Value Type to REG_DWORD and ensure the Value Data is 0. If the registry key structure does not exist on the client, the "Update" action will create it.

Once this policy propagates (you can test immediately by running gpupdate /force on a client machine), any attempt by that user to execute a VBS file will result in a strict system error stating, "Windows Script Host access is disabled on this machine." Please note that if you are currently using legacy VBS logon scripts for these users, this policy will block them; you should migrate those scripts to PowerShell or convert them to .cmd files before applying this restriction.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to Accept the Answer. Should you have more questions, feel free to leave a message. Have a nice day!

VP