Enable or Disable Windows Script Host Access

Windows Script Host (WSH) lets Windows run scripts written in VBScript and JScript, which are often used for legitimate automation but are also a common vector for malware. This guide shows you how to enable or disable WSH access using the Registry Editor, Group Policy, or the command line, so you can lock down your system or restore script functionality when needed.

What You’ll Need

• An account with administrative privileges on the Windows PC.
• For the Group Policy method: Windows Pro, Enterprise, or Education edition (Group Policy Editor is not available on Windows Home).
• For the Registry method: a backup of your registry (optional but recommended) and knowledge of how to use regedit.

Step-by-Step

Method 1: Using Registry Editor (All Windows Editions)

1. Press Win + R, type regedit, and press Enter. Click Yes if prompted by User Account Control.
2. Navigate to the following key:
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
   If the Settings folder does not exist, right-click on Windows Script Host, select New > Key, and name it Settings.
3. In the right pane, look for a DWORD value named Enabled. If it is not there, right-click in the empty space, select New > DWORD (32-bit) Value, and name it Enabled.
4. Double-click Enabled and set the value data to:
   • 1 to enable Windows Script Host (default).
   • 0 to disable Windows Script Host.
5. Click OK and close Registry Editor.
6. Restart your computer or sign out and back in for the change to take effect.

Method 2: Using Local Group Policy Editor (Windows Pro/Enterprise/Education)

1. Press Win + R, type gpedit.msc, and press Enter.
2. Navigate to:
   Computer Configuration > Administrative Templates > Windows Components > Windows Script Host
3. Double-click the policy Turn off Windows Script Host.
4. Set it to:
   • Enabled to disable WSH (this is the opposite of the registry value).
   • Disabled or Not Configured to enable WSH.
5. Click OK, then close Group Policy Editor.
6. Run gpupdate /force in a command prompt (as administrator) or restart the computer.

Method 3: Using Command Line (Quick Toggle)

1. Open Command Prompt as administrator: press Win + X and select Terminal (Admin) or Command Prompt (Admin).
2. To disable WSH, run:
   reg add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 0 /f
3. To enable WSH, run:
   reg add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /f
4. Close the command prompt. The change is immediate, but a restart may be needed for some applications to pick it up.

Common Mistakes

• Using the wrong registry path: The key must be under HKEY_LOCAL_MACHINE, not HKEY_CURRENT_USER, unless you want to apply it only to the current user. For system-wide control, use the HKLM path.
• Mixing up the policy and registry values: In Group Policy, Enabled means WSH is turned off. In the registry, 1 means WSH is on. Confusing these can lead to the opposite of what you intended.
• Not creating the Settings key: If you manually type the path and the Settings key does not exist, regedit will not create it automatically—you must create it as described.
• Forgetting to restart: Some applications check the setting only at startup, so a restart may be necessary for the change to take full effect.

Tips

• Before editing the registry, export the key (File > Export) so you can restore it if something goes wrong.
• If you are disabling WSH to block malware, also consider disabling macros in Office and keeping your antivirus updated, as scripts are only one attack vector.
• To test if WSH is disabled, try running a simple VBScript file (e.g., a file with MsgBox "test"). If disabled, you will get an error like “Windows Script Host access is disabled on this machine.”
• If you use legitimate scripts, create an exception by enabling WSH only when needed, then disable it again after running the script.

Troubleshooting

• Change does not take effect: Verify the registry value is set correctly and that you are looking at the right key. Run reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled to confirm. If the value is present, restart the computer.
• Group Policy overrides registry: If you have set the Group Policy to disable WSH, the registry setting will be ignored. Check both settings and make them consistent.
• Cannot find the Settings key: On some systems, the key may not exist until you create it. Follow the steps to create it manually.
• Scripts still run after disabling: Some scripts use alternate hosts (like cscript.exe) that may not be affected. Disabling WSH only affects the Windows Script Host, not other scripting engines. Ensure you have also disabled the relevant services if needed.
• Access denied when editing registry: Make sure you are running regedit as administrator. Right-click on regedit and select “Run as administrator”.

Frequently Asked Questions

Will disabling Windows Script Host break my system?

No, Windows itself does not rely on WSH for core functionality. However, some third-party applications and administrative scripts may stop working. You can re-enable it anytime.

Can I disable WSH for only one user?

Yes, you can set the Enabled value under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script Host\Settings to affect only that user. This is useful for shared computers.

Is Windows Script Host the same as PowerShell?

No. WSH runs VBScript and JScript, while PowerShell is a separate, more powerful scripting environment. Disabling WSH does not affect PowerShell.

How do I know if WSH is currently enabled?

Open Command Prompt and run reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled. If the value is 0x1, it is enabled; if 0x0, it is disabled. If the value is missing, it is enabled by default.

Will disabling WSH stop all VBScript malware?

It will stop most WSH-based VBScript malware from running, but some malware uses other vectors like PowerShell, macros, or exploits. It is a good security measure but not a complete solution.

Can I enable WSH temporarily without editing the registry?

You can run a script with the command-line host by typing cscript script.vbs even when WSH is disabled, but that may not work if the host is blocked by the same policy. The registry method is the most reliable.

Related

• Not Enough Memory Error on Windows 10: Fixes That Work
• Install Arch Linux in WSL: Full Guide
• How to Fix Adobe Creative Cloud Error 717 on Windows