Customize message for Access Denied errors: registry value Enabled and 9 moreComputerHKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied

Policy ID: AccessDeniedConfiguration
Scope: Computer Configuration
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Source: Administrative Templates (.admx) for Windows 11 2026 Update (26H2) (version 1.0)
Category: System › Access-Denied Assistance

Registry

Enabled

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Enabled value: 1
Disabled value: 0

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Enabled
"Enabled"=dword:00000001
; Disabled
"Enabled"=dword:00000000

CMD

:: Options (use only one)

:: Enabled
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "Enabled" /t REG_DWORD /d 1 /f
:: Disabled
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "Enabled" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Enabled
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'Enabled' -PropertyType DWord -Value 1 -Force | Out-Null
# Disabled
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'Enabled' -PropertyType DWord -Value 0 -Force | Out-Null

ErrorMessage

REG_MULTI_SZComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Enabled value: Depends on the option value
Element: -
Value type: REG_MULTI_SZ
Maximum number of strings: 15
Maximum length: 10240

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Value names and types follow the ADMX. Replace <enter value> below with your own data
; hex(2) and hex(7) data must be written as hexadecimal (UTF-16LE)
"ErrorMessage"=hex(7):<enter value>

CMD

:: Value names and types follow the ADMX. Replace <enter value> below with your own data

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "ErrorMessage" /t REG_MULTI_SZ /d "<enter value>" /f

PowerShell

# Value names and types follow the ADMX. Replace <enter value> below with your own data

New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'ErrorMessage' -PropertyType MultiString -Value '<enter value>' -Force | Out-Null

AllowEmailRequests

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Checked: 1
Unchecked: 0
Element: Enable users to request assistance
Value type: REG_DWORD

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Checked
"AllowEmailRequests"=dword:00000001
; Unchecked
"AllowEmailRequests"=dword:00000000

CMD

:: Options (use only one)

:: Checked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "AllowEmailRequests" /t REG_DWORD /d 1 /f
:: Unchecked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "AllowEmailRequests" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Checked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AllowEmailRequests' -PropertyType DWord -Value 1 -Force | Out-Null
# Unchecked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AllowEmailRequests' -PropertyType DWord -Value 0 -Force | Out-Null

EmailMessage

REG_MULTI_SZComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Enabled value: Depends on the option value
Element: -
Value type: REG_MULTI_SZ
Maximum number of strings: 15
Maximum length: 10240

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Value names and types follow the ADMX. Replace <enter value> below with your own data
; hex(2) and hex(7) data must be written as hexadecimal (UTF-16LE)
"EmailMessage"=hex(7):<enter value>

CMD

:: Value names and types follow the ADMX. Replace <enter value> below with your own data

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "EmailMessage" /t REG_MULTI_SZ /d "<enter value>" /f

PowerShell

# Value names and types follow the ADMX. Replace <enter value> below with your own data

New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'EmailMessage' -PropertyType MultiString -Value '<enter value>' -Force | Out-Null

PutDataOwnerOnTo

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Checked: 1
Unchecked: 0
Element: Folder owner
Value type: REG_DWORD

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Checked
"PutDataOwnerOnTo"=dword:00000001
; Unchecked
"PutDataOwnerOnTo"=dword:00000000

CMD

:: Options (use only one)

:: Checked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "PutDataOwnerOnTo" /t REG_DWORD /d 1 /f
:: Unchecked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "PutDataOwnerOnTo" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Checked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutDataOwnerOnTo' -PropertyType DWord -Value 1 -Force | Out-Null
# Unchecked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutDataOwnerOnTo' -PropertyType DWord -Value 0 -Force | Out-Null

PutAdminOnTo

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Checked: 1
Unchecked: 0
Element: File server administrator
Value type: REG_DWORD

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Checked
"PutAdminOnTo"=dword:00000001
; Unchecked
"PutAdminOnTo"=dword:00000000

CMD

:: Options (use only one)

:: Checked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "PutAdminOnTo" /t REG_DWORD /d 1 /f
:: Unchecked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "PutAdminOnTo" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Checked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutAdminOnTo' -PropertyType DWord -Value 1 -Force | Out-Null
# Unchecked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'PutAdminOnTo' -PropertyType DWord -Value 0 -Force | Out-Null

AdditonalEmailTo

REG_SZComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Enabled value: Depends on the option value
Element: Additional recipients:
Value type: REG_SZ
Maximum length: 2048

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Value names and types follow the ADMX. Replace <enter value> below with your own data
"AdditonalEmailTo"="<enter value>"

CMD

:: Value names and types follow the ADMX. Replace <enter value> below with your own data

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "AdditonalEmailTo" /t REG_SZ /d "<enter value>" /f

PowerShell

# Value names and types follow the ADMX. Replace <enter value> below with your own data

New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'AdditonalEmailTo' -PropertyType String -Value '<enter value>' -Force | Out-Null

IncludeDeviceClaims

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Checked: 1
Unchecked: 0
Element: Include device claims
Value type: REG_DWORD

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Checked
"IncludeDeviceClaims"=dword:00000001
; Unchecked
"IncludeDeviceClaims"=dword:00000000

CMD

:: Options (use only one)

:: Checked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "IncludeDeviceClaims" /t REG_DWORD /d 1 /f
:: Unchecked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "IncludeDeviceClaims" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Checked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeDeviceClaims' -PropertyType DWord -Value 1 -Force | Out-Null
# Unchecked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeDeviceClaims' -PropertyType DWord -Value 0 -Force | Out-Null

IncludeUserClaims

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Checked: 1
Unchecked: 0
Element: Include user claims
Value type: REG_DWORD

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Checked
"IncludeUserClaims"=dword:00000001
; Unchecked
"IncludeUserClaims"=dword:00000000

CMD

:: Options (use only one)

:: Checked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "IncludeUserClaims" /t REG_DWORD /d 1 /f
:: Unchecked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "IncludeUserClaims" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Checked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeUserClaims' -PropertyType DWord -Value 1 -Force | Out-Null
# Unchecked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'IncludeUserClaims' -PropertyType DWord -Value 0 -Force | Out-Null

GenerateLog

REG_DWORDComputer

HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied Current key

Checked: 1
Unchecked: 0
Element: Log emails in Application and Services event log
Value type: REG_DWORD

Apply with .reg · CMD · PowerShell

.reg

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied]

; Options (use only one)
; Checked
"GenerateLog"=dword:00000001
; Unchecked
"GenerateLog"=dword:00000000

CMD

:: Options (use only one)

:: Checked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "GenerateLog" /t REG_DWORD /d 1 /f
:: Unchecked
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied" /v "GenerateLog" /t REG_DWORD /d 0 /f

PowerShell

# Common: create the key
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Force | Out-Null

# Options (use only one)
# Checked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'GenerateLog' -PropertyType DWord -Value 1 -Force | Out-Null
# Unchecked
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\ADR\AccessDenied' -Name 'GenerateLog' -PropertyType DWord -Value 0 -Force | Out-Null