By default, Microsoft Edge is designed to block intrusive pop-ups on most websites while allowing them on trusted sites, or prompting the user when a site requests to open one. While this balanced approach is fine for general consumers, enterprise environments often require absolute certainty. In a highly secure kiosk deployment, a standardized testing environment, or a locked-down corporate workstation, allowing users the ability to manually override pop-up blockers or interact with unsolicited secondary windows introduces significant security risks, including phishing overlays and drive-by downloads.
This guide explains how to completely disable pop-ups system-wide in Microsoft Edge using Group Policy, enforcing a strict, unyielding block that users cannot bypass or reconfigure.
Disable Pop-ups via Group Policy
To enforce a strict block that overrides any local browser settings and prevents the user from toggling the pop-up blocker off, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.
- Log into Windows 11 with an Administrator account.
- Press the Windows Key + R to open the Run dialogue box.
- Type
gpedit.mscand press Enter to launch the Local Group Policy Editor. - In the left-hand navigation pane, navigate precisely to this path:
Computer Configuration > Administrative Templates > Microsoft Edge - In the right-hand pane, locate the policy named Default pop-up setting.
- Double-click the policy to open its configuration window.
- Select the radio button next to Enabled.
- In the Options pane below, click the drop-down menu and explicitly select Do not allow any site to show pop-ups.
- Click Apply, then click OK.
Verify the Security Lockdown
Group Policy changes require the browser to read the registry upon its next launch. Close all active instances of Microsoft Edge.
To verify the restriction is active, reopen Microsoft Edge and navigate to Settings > Cookies and site permissions > Pop-ups and redirects. The master toggle for “Block (recommended)” will be locked in the ‘On’ position and completely greyed out. A briefcase icon will appear next to it, indicating that the setting is managed by your organization. The browser will now aggressively intercept and destroy all pop-up window requests unconditionally across all domains.