How to Completely Disable ‘Encrypted Client Hello’ (ECH) via Group Policy in Microsoft Edge

Encrypted Client Hello (ECH) is a privacy feature in modern web browsers, including Microsoft Edge, designed to encrypt the Server Name Indication (SNI) during the TLS handshake. This prevents internet service providers and network administrators from seeing which specific websites a user is connecting to. While excellent for personal privacy, ECH can severely disrupt enterprise networks that rely on SNI for web filtering, deep packet inspection, and firewall security policies. In these environments, administrators must disable ECH to maintain network visibility and enforce organizational security controls.

This guide provides a comprehensive method to completely disable the Encrypted Client Hello feature in Microsoft Edge using the Windows Group Policy Editor. By configuring this policy, you can ensure that Edge transmits the SNI in plaintext, restoring compatibility with enterprise network monitoring tools.

Prerequisites

Before proceeding, ensure you meet the following requirements:

• Administrative privileges on the Windows 11 or Windows 10 machine.
• Access to the Group Policy Editor (available in Pro, Enterprise, and Education editions).
• The latest Microsoft Edge Administrative Templates downloaded and installed in your PolicyDefinitions folder.

How to Disable ‘Encrypted Client Hello’ via Group Policy

Follow these steps to deploy the policy and disable ECH across Microsoft Edge:

1. Press the Windows Key + R to open the Run dialog box.
2. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
3. In the left pane, navigate to the following path:
   Computer Configuration > Administrative Templates > Microsoft Edge
4. In the right pane, locate the policy named Enable Encrypted ClientHello.
5. Double-click on the policy to open its configuration window.
6. Select the Disabled radio button. (Setting it to Disabled explicitly forces ECH off, while ‘Not Configured’ leaves it to the browser’s default behavior).
7. Click Apply and then OK to save the changes.
8. To ensure the policy takes immediate effect, open a Command Prompt as Administrator and run the command: gpupdate /force.
9. Restart Microsoft Edge.

Verifying the Changes

To confirm that Encrypted Client Hello has been successfully disabled:

• Open Microsoft Edge and type edge://policy in the address bar, then press Enter.
• Look for the policy name EncryptedClientHelloEnabled.
• Ensure the Policy Value is set to false, confirming that the feature is deactivated and your network filtering tools will function correctly.