Home / server / Questions / 104623
Accepted
Kara Marfia
Asked: 2010-01-21 07:07:36 +0800 CST

Local policy to disable 16-bit execution?

  • 772

Motivated initially by this article, there doesn't seem to be any reason to leave 16-bit execution enabled at all, but particularly on my DMZ, where anything that shrinks the attack surface just makes my day happier.

Disabling this is a snap in group policy - Computer Configuration/Policies/Administrative Templates/Windows Components/Application Compatibility/Prevent access to 16-bit applications

However, does anybody know where to find this in a non-domain joined computer, with only Local Security Settings? Or elsewhere?

windows configuration

2 Answers

  1. Best Answer

    You can set this setting "manually" by adding a REG_DWORD value named "VDMDisallowed", set to "1", at "HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\AppCompat". I'd just script using the REG command to set it:

    REG ADD HKLM\Software\Policies\Microsoft\Windows\AppCompat /t REG_DWORD /v VDMDisallowed /d 1
    • 2

  2. Tanks for the script, much easier - and quicker - than going through the registry and adding it manually.

    Oops, my bad! First time commenting here, didn't see how to reply to the first answer.

    Sorry!

    • 0