How to Completely Disable ‘Automatic Downloads’ via Group Policy in Microsoft Edge

Modern web browsers are designed to streamline the user experience by allowing trusted websites to automatically trigger multiple file downloads in sequence (often used when exporting reports or downloading image galleries). In Microsoft Edge, if a user approves an initial download, subsequent files can be pushed to the local disk without additional prompts. While highly convenient for productivity, this capability represents a severe operational security (OPSEC) and malware delivery risk in secure enterprise deployments. Malicious actors, drive-by download sites, or compromised advertising networks can exploit the automatic download API to silently dump executable payloads, ransomware droppers, or tracking scripts onto the corporate endpoint without the user’s explicit interaction or awareness.

This guide explains how to completely disable ‘Automatic Downloads’ via Group Policy in Microsoft Edge, enforcing a strict zero-trust posture that mandates explicit user consent for every single file transfer initiated by a remote server.

Disable Automatic Downloads via Group Policy

To enforce a strict configuration that explicitly strips the Chromium engine of its ability to process automatic, sequential file transfers, thereby overriding any user-defined site settings, we must deploy an administrative template.

1. Log into Windows with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Microsoft Edge

5. In the right-hand pane, locate the policy named Default automatic downloads setting (internally known as DefaultWebBluetoothGuardSetting… wait, no, the internal name is DefaultPluginsSetting … actually, it is just Default automatic downloads setting).
6. Double-click the policy to open its configuration window.
7. Select the radio button next to Enabled.
8. Under the Options section, locate the dropdown menu labeled “Default automatic downloads setting”.
9. Explicitly select Do not allow any site to download multiple files automatically (Value: 2). (By explicitly setting this to ‘Block’, we instruct the browser’s download manager to instantly intercept and block any secondary file transfer initiated by the DOM, guaranteeing that malware cannot silently chain-download payloads).
10. Click Apply, then click OK.

Verify the Configuration Lockdown

Group Policy changes modifying the Chromium download manager require the browser to restart to apply the new security baseline.

Close all active instances of Microsoft Edge. To force the policy update immediately across the OS, open Command Prompt as Administrator and run gpupdate /force. To verify the restriction is active, launch Microsoft Edge and navigate to edge://settings/content/automaticDownloads. You will find that the global toggle for “Ask when a site tries to download multiple files automatically” is completely greyed out and locked in the “Blocked” state. At the top of the settings page, a briefcase icon will state, “Your browser is managed by your organization.” If you navigate to a website that attempts to initiate a sequential download, the browser will strictly block it, ensuring total OPSEC compliance.