Microsoft KB Archive/216384

{|
 * width="100%"|

INFO: Approved Shell Extensions Only Enforced If EnforceShellExtensionSecurity Key Is Turned On

 * }

Q216384

-

The information in this article applies to:


 * Microsoft Win32 Software Development Kit (SDK), used with:
 * Microsoft Windows NT Server version 4.0
 * Microsoft Windows NT Workstation version 4.0
 * the operating system: Microsoft Windows 2000

-

SUMMARY
The Approved key and the EnforceShellExtensionSecurity policy are an administrator's way of controlling which shell extensions are allowed to run. If the EnforceShellExtensionSecurity policy is turned on, the shell will only run shell extensions that are registered under the Approved key. If the EnforceShellExtensionSecurity policy is turned off, any shell extension can be run, whether or not it is registered under the Approved key.

MORE INFORMATION
The CLSIDs for approved shell extensions are registered under the registry key:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

EnforceShellExtensionSecurity is a REG_DWORD value placed under the following key:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]

EnforceShellExtensionSecurity is off when the value is zero or is removed, and on when the value is 1.