ActiveX Control Initialization: registry value uficontrolsUserHKCU\software\policies\microsoft\office\common\security

Policy ID: L_ActiveXControlInitialization
Scope: User Configuration
Supported on: At least Windows Server 2008 R2 or Windows 7
Source: Microsoft 365 Apps / Office Administrative Templates (version 5568.1000)
Category: Microsoft Office 2016 › Security Settings

This policy setting specifies the Microsoft ActiveX® initialization security level for all Microsoft Office applications. ActiveX controls can adversely affect a computer directly. In addition, malicious code can be used to compromise an ActiveX control and attack a computer. To indicate the safety of an ActiveX control, developers can denote them as Safe For Initialization (SFI). SFI indicates that a control is safe to open and run, and that it is not capable of causing a problem for any computer, regardless of whether it has persisted data values or not. If a control is not marked SFI, it is possible that the control could adversely affect a computer--or it could mean that the developers did not test the control in all situations and are not sure whether it might be compromised in the future.

If you enable this policy setting, you can set the ActiveX security level to a number between 1 and 6. These security levels are as follows:

1 - Regardless of how the control is marked, load it and use the persisted values (if any). This setting does not prompt the user.

2 - If SFI, load the control in safe mode and use persisted values (if any). If not SFI, load in unsafe mode with persisted values (if any), or use the default (first-time initialization) settings. This level is similar to the default configuration, but does not prompt the user.

3 - If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings.

4 - If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with default (first-time initialization) settings.

5 - If SFI, load the control in unsafe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values.

6 - If SFI, load the control in safe mode and use persisted values (if any). If not SFI, prompt the user and advise them that it is marked unsafe. If the user chooses No at the prompt, do not load the control. Otherwise, load it with persisted values.

If you disable or do not configure this policy setting, if a control is marked SFI, the application loads the control in safe mode and uses persisted values (if any). If the control is not marked SFI, the application loads the control in unsafe mode with persisted values (if any), or uses the default (first-time initialization) settings. In both situations, the Message Bar informs users that the controls have been disabled and prompts them to respond.

Important - Some ActiveX controls do not respect the safe mode registry setting, and therefore might load persisted data even though you configure this setting to instruct the control to use safe mode. This setting only increases security for ActiveX controls that are accurately marked as SFI. In situations that involve malicious or poorly designed code, an ActiveX control might be inaccurately marked as SFI.

See the full description on the Group Policy page ›

Registry

uficontrols

REG_DWORDUser

HKCU\software\policies\microsoft\office\common\security Current key

Enabled value: Depends on the option value
Element: ActiveX Control Initialization:

Options
Item	Stored value
1	1
2	2
3	3
4	4
5	5
6	6

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\software\policies\microsoft\office\common\security]

; Options (use only one)
; 1
"uficontrols"=dword:00000001
; 2
"uficontrols"=dword:00000002
; 3
"uficontrols"=dword:00000003
; 4
"uficontrols"=dword:00000004
; 5
"uficontrols"=dword:00000005
; 6
"uficontrols"=dword:00000006

CMD

:: Options (use only one)

:: 1
reg add "HKCU\software\policies\microsoft\office\common\security" /v "uficontrols" /t REG_DWORD /d 1 /f
:: 2
reg add "HKCU\software\policies\microsoft\office\common\security" /v "uficontrols" /t REG_DWORD /d 2 /f
:: 3
reg add "HKCU\software\policies\microsoft\office\common\security" /v "uficontrols" /t REG_DWORD /d 3 /f
:: 4
reg add "HKCU\software\policies\microsoft\office\common\security" /v "uficontrols" /t REG_DWORD /d 4 /f
:: 5
reg add "HKCU\software\policies\microsoft\office\common\security" /v "uficontrols" /t REG_DWORD /d 5 /f
:: 6
reg add "HKCU\software\policies\microsoft\office\common\security" /v "uficontrols" /t REG_DWORD /d 6 /f

PowerShell

# Common: create the key
New-Item -Path 'HKCU:\software\policies\microsoft\office\common\security' -Force | Out-Null

# Options (use only one)
# 1
New-ItemProperty -Path 'HKCU:\software\policies\microsoft\office\common\security' -Name 'uficontrols' -PropertyType DWord -Value 1 -Force | Out-Null
# 2
New-ItemProperty -Path 'HKCU:\software\policies\microsoft\office\common\security' -Name 'uficontrols' -PropertyType DWord -Value 2 -Force | Out-Null
# 3
New-ItemProperty -Path 'HKCU:\software\policies\microsoft\office\common\security' -Name 'uficontrols' -PropertyType DWord -Value 3 -Force | Out-Null
# 4
New-ItemProperty -Path 'HKCU:\software\policies\microsoft\office\common\security' -Name 'uficontrols' -PropertyType DWord -Value 4 -Force | Out-Null
# 5
New-ItemProperty -Path 'HKCU:\software\policies\microsoft\office\common\security' -Name 'uficontrols' -PropertyType DWord -Value 5 -Force | Out-Null
# 6
New-ItemProperty -Path 'HKCU:\software\policies\microsoft\office\common\security' -Name 'uficontrols' -PropertyType DWord -Value 6 -Force | Out-Null