Untrusted Font Blocking

Policy ID: FontMitigation
Scope: Computer Configuration
Supported on: At least Windows Server 2016, Windows 10
Source: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category: System › Mitigation Options

Description

This security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the %windir%\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit. By default, it is Off and no fonts are blocked. If you aren't quite ready to deploy this feature into your organization, you can run it in Audit mode to see if blocking untrusted fonts causes any usability or compatibility issues.

Options

Mitigation Options
- Block untrusted fonts and log events
- Do not block untrusted fonts
- Log events without blocking untrusted fonts

Registry

ComputerHKEY_LOCAL_MACHINE

HKLM\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions View registry values

MitigationOptions_FontBockingREG_SZ

Other policies in the same category

View all policies in this category (2)