How to Completely Disable ‘Windows Script Host’ (WSH) via Group Policy in Windows 11

Windows Script Host (WSH) is a powerful, legacy automation technology built into Windows that allows administrators to execute scripts written in VBScript (.vbs) or JScript (.js) directly on the desktop. While it was once a staple of system administration, WSH has become one of the most dangerous and actively exploited attack vectors for malware, particularly ransomware. Because these scripts are natively trusted and executed by wscript.exe or cscript.exe, malicious payloads embedded in Office macros or deceptive email attachments can use WSH to silently download and execute secondary malware payloads without triggering traditional antivirus alarms. In modern environments where PowerShell is the standard for administration, WSH is entirely obsolete and should be eradicated.

This guide explains how to completely disable Windows Script Host system-wide using the Group Policy Editor in Windows 11, neutralizing a massive threat vector.

Disable Windows Script Host via Group Policy

To enforce a strict block that prevents the execution of any VBScript or JScript files, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Script Host

5. In the right-hand pane, locate the policy named Turn off Windows Script Host. (If you do not see this specific folder, WSH is often managed directly via the registry, but some custom ADMX templates expose it here).
6. Alternative Registry Method (if the Group Policy folder is missing): Open regedit.exe and navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings. Create a new DWORD (32-bit) Value named Enabled and set its value data to 0.

Verify the Security Lockdown

To enforce the change immediately, a system reboot is recommended.

To verify the restriction is active, open Notepad, type a simple script like WScript.Echo "Test", and save the file to your desktop as test.vbs. Double-click the file to execute it. Instead of displaying a dialog box, the system will immediately throw a critical error stating: “Windows Script Host access is disabled on this machine. Contact your administrator for details.” Your endpoint is now securely hardened against legacy script-based malware attacks.