Windows 10: Exclude Specific Apps for Untrusted Font Blocking in Windows 10

How to: Exclude Specific Apps for Untrusted Font Blocking in Windows 10

How to Exclude Specific Apps for Untrusted Font Blocking in Windows 10


A font is a graphical representation of text that may include a different typeface, point size, weight, color, or design.

The Untrusted Font Blocking security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the C:\Windows\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit.

After you turn this feature on, or start using Audit mode, you can look at your event logs for details.

Users may still need apps that have problems because of blocked fonts, so it is suggested that you first run this feature in Audit mode to determine which fonts are causing the problems. After you figure out the problematic fonts, you can try to fix your apps in one of two ways: by directly installing the fonts into the %windir%/Fonts directory or by excluding the underlying processes (apps) and letting the fonts load. As the default solution, it is highly recommend that you install the problematic font. Installing fonts is safer than excluding apps because excluded apps can load any font, trusted or untrusted.

[table][tr][td]Untrusted Font Blocking Mode[/td] [td]Description[/td] [/tr] [tr][td]On (enable)[/td] [td]Block untrusted fonts and log events. Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log.[/td] [/tr] [tr][td]Off (default - disable)[/td] [td]Turns the feature off.[/td] [/tr] [tr][td]Audit[/td] [td]Log events without blocking untrusted fonts. Turns the feature on, logging installation attempts to the event log, but not blocking untrusted fonts.[/td] [/tr] [/table]

See also: Block untrusted fonts in an enterprise | Microsoft Docs

This tutorial will show you how to exclude specific apps from Untrusted Font Blocking for all users in Windows 10.

*note You must be signed in as an administrator to exclude apps from Untrusted Font Blocking.




Here's How:

1. Check the Untrusted Font Blocking event logs to see which app (iexplorer.exe) you want to exclude. (see screenshot below)



2. Press the Win+R keys to open Run, type regedit into Run, and click/tap on OK to open Registry Editor.

3. Navigate to the key below in the left pane of Registry Editor. (see screenshot below)
*Arrow HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options




4. Under the expanded open Image File Execution Options key in the left pane, look to see if a subkey (ex: "iexplorer.exe") for the app already exists. If not, then right click on the Image File Execution Options key, click/tap on New, click/tap on Key, type the file name of the app (ex: "iexplorer.exe") for the key's name, and press Enter. (see screenshot below step 3)

5. In the right pane of the app's key (ex: "iexplorer.exe"), double click/tap on the MitigationOptions QWORD to modify it. (see screenshot below step 3)

*note If there is not a MitigationOptions QWORD, then right click on an empty area in the right pane of the app's key (ex: "iexplorer.exe"), click/tap on New, click/tap on QWORD (64-bit) Value, type MitigationOptions for the name, and press Enter.

6. Select (dot) Hexadecimal, type the data value in the table below you want to use, and click/tap on OK. (see screenshot below)




[table][tr][td]QWORD data value (hex)[/td] [td]Description[/td] [/tr] [tr][td]100[/td] [td]Default. Uses what you set (block or audit) when enabling log events.[/td] [/tr] [tr][td]2000000000000[/td] [td]Exclude. Do not block untrusted fonts from app, and do not log events.[/td] [/tr] [tr][td]3000000000000[/td] [td]Audit mode. Do not block untrusted fonts from app, and log events.[/td] [/tr] [/table]

7. When finished managing exclusions for Untrusted Font Blocking, you can close Registry Editor.


That's it,
Shawn


Related Tutorials

• How to Enable or Disable Untrusted Font Blocking in Windows 10
• How to Read Event Viewer Log for Untrusted Font Blocking in Windows 10

:)

 

IE 11 blocking font download on some Specific PC's

Hi,

I am using ICOMOON to include fonts in WebAPP.

IE11 is blocking font download. The error displayed in the console is CSS3111.

This is happening on some of the PC's and not all the PC's.

Tried the following options...

1. Checked the Font Download option in the Internet Explorer settings. Font download is enabled Custom Level Settings.

2. Changed the Group Policy to Enable and set the value as "Do not block untrusted fonts". Earlier it was set to Not Configured.

3. Tried to turn on and use the Blocking Untrusted Fonts feature through the registry.

4. Converted the fonts to Base64 encoding but fonts were not rendered. (Refer the 2nd URL)

The following URL was referred to solve the Issue:

Block untrusted fonts in an enterprise (Windows 10)

data Protocol

These fonts can't be installed as these are custom Icon fonts.

Can anyone suggest any other option to fix this issue.

IE11 Version List where this Issue is observed.

11.1770.14393.0

11.1715.14393.0

11.1176.10586.0

Thanks.

 

How to block a specific app using family settings

Hi,

Blocking specific apps is possible with the Microsoft Account's Family Safety Feature. To block a specific application on your child's account, it is a requirement that the app must be used by your child, so that it will appear in under the Recent Activity
list. For your child's security, you can log in as the child and launch the app to satisfy this requirement.

Follow these steps to successfully block specific applications:

• Visit the Microsoft Family website and then sign in your Microsoft Account.
• Click the account of the child that you want to block from using an app.
• Select Recent Activity.
• Click to ensure that Activity Reporting is turned on.
• Scroll down and look for Apps & Games.
• Choose the apps that you want to block on your child's account.
• Click Block to block usage of the app.

If further assistance is needed, don't hesitate to reach out to us.

 

Blocked Publisher doesn't show up in Untrusted Publishers - how can I unblock the publisher?

I've already seen the following Post:

Hi samuel,

Welcome to Microsoft Community and thank you for your interest in Windows 10.

I understand the inconvenience that you are experiencing. I will definitely assist you.

To unblock a software publisher try the below steps:

• 
  Open Internet Explorer, click the Tools button, and then click Internet Options.
  
• 
  Go to the Content tab, Look under the Certificates section.
  
• 
  Click on Publishers button.
  
• 
  Select the Untrusted Publishers tab.
  
  • Select the Publisher you wish to unblock and click the Remove button.

This post does not solve my problem with a Blocked publisher, because When I check the "Untrusted Publisher's tab in Internet Explorer. there are no entries to remove.

Any other way to resolve this?

 

Blocked Publisher doesn't show up in Untrusted Publishers - how can I unblock the publisher?

Hi,

The software publisher won't appear in the Untrusted Publisher tab. Since, the steps you've provided didn't work, you unblock the publisher using Command Prompt. Please follow the steps below:

• Press Windows X, then select Command Prompt (Admin).
• Press Shift + right-click on the program you want to unblock.
• Click Copy as path, then paste in Command Prompt.
• Hit Enter.

Let us know the result.

 

Fonts are not displayed correctly on Windows 10 Internet Explorer 11

Font are not displayed correctly for web application on IE 11. On any other browsers font are displayed fine.

On further research of this issue we found that there is a security feature to block untrusted fonts. Disabling the following registry option has fixed the issue and all fonts are loaded perfectly.

To disable Untrusted Font Blocking using Registry Editor:

• Open Registry Editor (regedit.exe) and go to the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\
• If the MitigationOptions key is not there, right-click and add a new QWORD (64-bit) Value, naming it as MitigationOptions.
• To turn this feature off. Type 2000000000000.

To support our application we cant make this registry setting for all our clients. Is there any other way of fixing this issue other than changing the above registry option?