Windows 10: Enable or Disable Untrusted Font Blocking in Windows 10

How to: Enable or Disable Untrusted Font Blocking in Windows 10

How to Enable or Disable Untrusted Font Blocking in Windows 10


A font is a graphical representation of text that may include a different typeface, point size, weight, color, or design.

The Untrusted Font Blocking security feature provides a global setting to prevent programs from loading untrusted fonts. Untrusted fonts are any font installed outside of the C:\Windows\Fonts directory. This feature can be configured to be in 3 modes: On, Off, and Audit.

*note If you aren’t quite ready to enable Untrusted Font Blocking, you can run it in Audit mode to see if not loading untrusted fonts causes any usability or compatibility issues.

You can exclude specific apps, allowing them to load untrusted fonts, even while Untrusted Font Blocking is turned on.

[table][tr][td]Untrusted Font Blocking Mode[/td] [td]Description[/td] [/tr] [tr][td]On (enable)[/td] [td]Block untrusted fonts and log events. Turns the feature on, blocking untrusted fonts and logging installation attempts to the event log.[/td] [/tr] [tr][td]Off (default - disable)[/td] [td]Turns the feature off.[/td] [/tr] [tr][td]Audit[/td] [td]Log events without blocking untrusted fonts. Turns the feature on, logging installation attempts to the event log, but not blocking untrusted fonts.[/td] [/tr] [/table]


See also: Block untrusted fonts in an enterprise | Microsoft Docs

This tutorial will show you how to enable or disable Untrusted Font Blocking for all users in Windows 10.

*note You must be signed in as an administrator to enable or disable Untrusted Font Blocking.


CONTENTS:

• Option One: Enable or Disable Untrusted Font Blocking in Local Group Policy Editor
• Option Two: Enable or Disable Untrusted Font Blocking using a REG file

OPTION ONE [/i] Enable or Disable Untrusted Font Blocking in Local Group Policy Editor

*note The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Two below.
1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\System\Mitigation Options




3. In the right pane of Mitigation Options in Local Group Policy Editor, double click/tap on the Untrusted Font Blocking policy to edit it. (see screenshot above)

4. Do step 5 (enable), step 6 (disable), or step 7 (audit) below for what you would like to do.


5. To Enable Untrusted Font Blocking
A) Select (dot) Enabled, select Block untrusted fonts and log events in the "Mitigation Options" drop menu, click/tap on OK, and go to step 8 below. (see screenshot below)

6. To Disable Untrusted Font Blocking
A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 8 below. (see screenshot below)

*note Not Configured is the default setting.

7. To Use Audit Mode for Untrusted Font Blocking
A) Select (dot) Enabled, select Log events without blocking untrusted fonts in the "Mitigation Options" drop menu, click/tap on OK, and go to step 8 below. (see screenshot below)




8. When finished, you can close the Local Group Policy Editor.





OPTION TWO [/i] Enable or Disable Untrusted Font Blocking using a REG file
*note The downloadable .reg files below will add and modify the string value in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions

MitigationOptions_FontBocking string value (REG_SZ)

delete = Disable (off)
1000000000000 = Enable (on)
3000000000000 - Audit
1. Do step 2 (enable), step 3 (disable), or step 4 (audit) below for what you would like to do.


2. To Enable Untrusted Font Blocking
A) Click/tap on the Download button below to download the file below, and go to step 5 below.

Untrust_Font_Blocking-Block_untrusted_fonts_and_log_events.reg

Download

3. To Disable Untrusted Font Blocking
*note This is the default setting.
A) Click/tap on the Download button below to download the file below, and go to step 5 below.

Untrust_Font_Blocking-Do_not_block_untrusted_fonts.reg

Download

4. To Use Audit Mode for Untrusted Font Blocking
A) Click/tap on the Download button below to download the file below, and go to step 5 below.

Untrust_Font_Blocking_Log_events_without_blocking_untrusted_fonts.reg

Download
5. Save the .reg file to your desktop.

6. Double click/tap on the downloaded .reg file to merge it.

7. When prompted, click/tap on Run, OK (UAC), Yes, and OK to approve the merge.

8. Restart the computer to apply.

9. You can now delete the downloaded .reg file if you like.

That's it,
Shawn


Related Tutorials

• How to Read Event Viewer Log for Untrusted Font Blocking in Windows 10
• How to Exclude Specific Apps for Untrusted Font Blocking in Windows 10
• How to Install Fonts in Windows 10
• How to Get Fonts from the Microsoft Store in Windows 10
• How to Preview Fonts in Windows 10
• How to Delete Fonts in Windows 10
• How to Change the Default System Font in Windows 10
• How to Create Custom Font with Microsoft Font Maker app in Windows 10
• How to Hide or Show Fonts in Windows
• How to Backup and Restore Font Settings in Windows
• How to Restore Default Font Settings in Windows
• How to Enable or Disable Font Smoothing in Windows
• How to Rebuild Font Cache in Windows 10

:)

 

IE 11 blocking font download on some Specific PC's

Hi,

I am using ICOMOON to include fonts in WebAPP.

IE11 is blocking font download. The error displayed in the console is CSS3111.

This is happening on some of the PC's and not all the PC's.

Tried the following options...

1. Checked the Font Download option in the Internet Explorer settings. Font download is enabled Custom Level Settings.

2. Changed the Group Policy to Enable and set the value as "Do not block untrusted fonts". Earlier it was set to Not Configured.

3. Tried to turn on and use the Blocking Untrusted Fonts feature through the registry.

4. Converted the fonts to Base64 encoding but fonts were not rendered. (Refer the 2nd URL)

The following URL was referred to solve the Issue:

Block untrusted fonts in an enterprise (Windows 10)

data Protocol

These fonts can't be installed as these are custom Icon fonts.

Can anyone suggest any other option to fix this issue.

IE11 Version List where this Issue is observed.

11.1770.14393.0

11.1715.14393.0

11.1176.10586.0

Thanks.

 

Fonts are not displayed correctly on Windows 10 Internet Explorer 11

Font are not displayed correctly for web application on IE 11. On any other browsers font are displayed fine.

On further research of this issue we found that there is a security feature to block untrusted fonts. Disabling the following registry option has fixed the issue and all fonts are loaded perfectly.

To disable Untrusted Font Blocking using Registry Editor:

• Open Registry Editor (regedit.exe) and go to the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\
• If the MitigationOptions key is not there, right-click and add a new QWORD (64-bit) Value, naming it as MitigationOptions.
• To turn this feature off. Type 2000000000000.

To support our application we cant make this registry setting for all our clients. Is there any other way of fixing this issue other than changing the above registry option?

 

Fonts are not displayed correctly on Windows 10 Internet Explorer 11

As mentioned in my post if we disable the option to 'Untrusted Font Blocking' then the application works fine without any issues. I wanted to find an alternative solution other than disabling the option.

I submitted an incident/ticket with Microsoft. There was no resolution to make it work other than disabling the option, they recommend turning off the option for any Windows 10 user.

Here is the article which mentions the same from Microsoft:

Dropping the “Untrusted Font Blocking” setting

 

Blocked Publisher doesn't show up in Untrusted Publishers - how can I unblock the publisher?

I've already seen the following Post:

Hi samuel,

Welcome to Microsoft Community and thank you for your interest in Windows 10.

I understand the inconvenience that you are experiencing. I will definitely assist you.

To unblock a software publisher try the below steps:

• 
  Open Internet Explorer, click the Tools button, and then click Internet Options.
  
• 
  Go to the Content tab, Look under the Certificates section.
  
• 
  Click on Publishers button.
  
• 
  Select the Untrusted Publishers tab.
  
  • Select the Publisher you wish to unblock and click the Remove button.

This post does not solve my problem with a Blocked publisher, because When I check the "Untrusted Publisher's tab in Internet Explorer. there are no entries to remove.

Any other way to resolve this?

 

Blocked Publisher doesn't show up in Untrusted Publishers - how can I unblock the publisher?

Hi,

The software publisher won't appear in the Untrusted Publisher tab. Since, the steps you've provided didn't work, you unblock the publisher using Command Prompt. Please follow the steps below:

• Press Windows X, then select Command Prompt (Admin).
• Press Shift + right-click on the program you want to unblock.
• Click Copy as path, then paste in Command Prompt.
• Hit Enter.

Let us know the result.