How to Configure Microsoft Edge Download Restrictions and File Policies in Windows 11 Using PowerShell

In enterprise Windows 11 environments, web browsers represent the primary vector for malicious file ingress, including ransomware payloads, trojanized installers, malicious scripts, and untrusted office macros. While perimeter firewalls and endpoint detection and response (EDR) agents inspect traffic, enforcing strict security boundaries directly at the browser download boundary provides essential defense-in-depth. Microsoft Edge incorporates comprehensive enterprise download restriction controls built into the Chromium platform. Through PowerShell and Group Policy registry settings, IT administrators can enforce download restrictions, block specific file extensions, mandate secure download directories, and prevent users from bypassing SmartScreen security warnings.

Understanding Microsoft Edge Download Restriction Levels

Microsoft Edge provides the DownloadRestrictions policy to enforce granular download filtering across all browsing sessions. The policy accepts four operational integer modes:

• 0 (No Restrictions): The default setting. All file downloads are permitted subject only to standard SmartScreen reputation evaluations.
• 1 (Block Dangerous Downloads): Automatically blocks file downloads that SmartScreen flags as malicious or high-risk malware. Users cannot choose to “Keep anyway” or bypass the block.
• 2 (Block Potentially Unwanted and Dangerous Downloads): Blocks both confirmed malware and Potentially Unwanted Applications (PUAs), including cryptominers, adware, and bundled toolbars.
• 3 (Block All Downloads): Completely shuts down the download manager. No file downloads of any type are permitted. Highly recommended for dedicated kiosk PCs and public access terminals.

Auditing Existing Microsoft Edge Download Policies

To audit currently enforced Edge download policies, open an elevated PowerShell window on Windows 11.

Check the Microsoft Edge policy registry hive:

$EdgePolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

if (Test-Path $EdgePolicyPath) {
    Get-ItemProperty -Path $EdgePolicyPath |
        Select-Object DownloadRestrictions, DownloadDirectory, PromptForDownloadLocation -ErrorAction SilentlyContinue
} else {
    Write-Host "Microsoft Edge enterprise policy hive not configured." -ForegroundColor Yellow
}

If these properties return blank, Microsoft Edge operates using unmanaged defaults.

Enforcing Download Restrictions via PowerShell

To enforce strict download protection that blocks both malicious files and Potentially Unwanted Applications (PUAs) across all users on the workstation:

$EdgePolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"

# Ensure registry path exists
if (!(Test-Path $EdgePolicyPath)) {
    New-Item -Path $EdgePolicyPath -Force | Out-Null
}

# Set DownloadRestrictions to mode 2 (Block Dangerous and Potentially Unwanted Downloads)
Set-ItemProperty -Path $EdgePolicyPath `
    -Name "DownloadRestrictions" `
    -Value 2 `
    -Type DWord

# Prevent users from bypassing SmartScreen warnings on downloads
Set-ItemProperty -Path $EdgePolicyPath `
    -Name "PreventSmartScreenPromptOverrideForFiles" `
    -Value 1 `
    -Type DWord

Write-Host "Edge download restrictions successfully enforced." -ForegroundColor Green

Blocking Specific File Extensions and MIME Types

In high-security environments, you may want to permit general PDF and document downloads while explicitly forbidding executable scripts (such as .exe, .bat, .vbs, .iso, or .ps1).

You can configure the file type blacklist policy via PowerShell:

$FileBlockPath = "$EdgePolicyPath\ExemptDomainFileTypePairsFromFileTypeDownloadWarnings"

# Configure extension restrictions using the URLBlocklist / Download policy
# To enforce extension blocks directly:
$ExtensionPath = "$EdgePolicyPath\FileOrURLTypeBlocklist"
New-Item -Path $ExtensionPath -Force | Out-Null

Set-ItemProperty -Path $ExtensionPath -Name "1" -Value "*.exe" -Type String
Set-ItemProperty -Path $ExtensionPath -Name "2" -Value "*.bat" -Type String
Set-ItemProperty -Path $ExtensionPath -Name "3" -Value "*.vbs" -Type String
Set-ItemProperty -Path $ExtensionPath -Name "4" -Value "*.iso" -Type String

Mandating a Fixed Corporate Download Directory

By default, Microsoft Edge places downloaded files in the user’s personal Downloads folder and allows users to choose alternate locations. In corporate environments, directing all downloads to an audited path monitored by real-time antivirus scanners simplifies security monitoring.

To mandate a locked download path and disable the “Ask where to save each file” dialogue:

# Enforce mandatory download location (e.g. C:\CorporateDownloads)
Set-ItemProperty -Path $EdgePolicyPath `
    -Name "DownloadDirectory" `
    -Value "C:\CorporateDownloads" `
    -Type String

# Prevent user prompt to select an alternate directory
Set-ItemProperty -Path $EdgePolicyPath `
    -Name "PromptForDownloadLocation" `
    -Value 0 `
    -Type DWord

Completely Blocking All Downloads on Kiosk Terminals

For publicly accessible terminals, interactive displays, or shared training machines where file downloads pose severe security risks:

# Enforce mode 3: Block all downloads unconditionally
Set-ItemProperty -Path $EdgePolicyPath `
    -Name "DownloadRestrictions" `
    -Value 3 `
    -Type DWord

When a user attempts to download any file, Microsoft Edge immediately cancels the operation and displays a notification stating “Your organization has blocked downloads.”

Verifying Enforced Policies Inside Microsoft Edge

To confirm that registry changes have been successfully ingested by the browser engine:

1. Open Microsoft Edge on Windows 11.
2. In the address bar, navigate to edge://policy.
3. Click Reload Policies.
4. Locate DownloadRestrictions, PreventSmartScreenPromptOverrideForFiles, and DownloadDirectory.
5. Verify that each policy displays OK with the designated policy values applied from Platform (Machine).

Configuring Microsoft Edge download restrictions via PowerShell establishes a hardened first line of defense, blocking malicious payloads and securing corporate data across Windows 11 endpoints.