Restrict potentially unsafe HTML Help functions to specified folders

ComputerNative Intune settingHelpQualifiedRootDir_Comp

Supported on At least Internet Explorer 6 Service Pack 1

25H2 · 1.0

What it does

This policy setting allows you to restrict certain HTML Help commands to function only in HTML Help (.chm) files within specified folders and their subfolders. Alternatively, you can disable these commands on the entire system. It is strongly recommended that only folders requiring administrative privileges be added to this policy setting. If you enable this policy setting, the commands function only for .chm files in the specified folders and their subfolders. To restrict the commands to one or more folders, enable the policy setting and enter the desired folders in the text box on the Settings tab of the Policy Properties dialog box. Use a semicolon to separate folders. For example, to restrict the commands to only .chm files in the %windir%\help folder and D:\somefolder, add the following string to the edit box: "%windir%\help;D:\somefolder". Note: An environment variable may be used, (for example, %windir%), as long as it is defined on the system. For example, %programfiles% is not defined on some early versions of Windows. The "Shortcut" command is used to add a link to a Help topic, and runs executables that are external to the Help file. The "WinHelp" command is used to add a link to a Help topic, and runs a WinHLP32.exe Help (.hlp) file. To disallow the "Shortcut" and "WinHelp" commands on the entire local system, enable the policy setting and leave the text box on the Settings tab of the Policy Properties dialog box blank. If you disable or do not configure this policy setting, these commands are fully functional for all Help files. Note: Only folders on the local computer can be specified in this policy setting. You cannot use this policy setting to enable the "Shortcut" and "WinHelp" commands for .chm files that are stored on mapped drives or accessed using UNC paths. For additional options, see the "Restrict these programs from being launched from Help" policy.

What it writes

Hive: HKEY_LOCAL_MACHINE
Registry key: Software\Policies\Microsoft\Windows\System

Why it needs changes for Intune

Policy references a Windows supportedOn definition.
ADMX-INTUNE-WINDOWS-SUPPORTEDON-REFERENCE

In Intune

Native Intune setting: Yes — Policy CSP

./Device/Vendor/MSFT/Policy/Config/ADMX_Help/HelpQualifiedRootDir_CompADMX_Help on Microsoft LearnADMX-backed: Windows ships this template, so it is set with the template's own values, without an import.Windows builds listed: 10.0.22000, 10.0.19043.1202, 10.0.19042.1202, 10.0.19041.1202.

From Microsoft's Policy CSP DDF files (DDF v2 Files, February 2026), read 18 Oct 2026.

Options

Option	Type	Registry value	Allowed values
Enter folder names separated by semi-colons	Text	`HelpQualifiedRootDir`	Up to 255 characters

Configure and deploy

Choose a state and the option values; the output below is generated from the template for exactly that.

Enabled · Computer · template defaults

Registry file (.reg)

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System]
"HelpQualifiedRootDir"=""

PowerShell

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Restrict potentially unsafe HTML Help functions to specified folders
# Name: HelpQualifiedRootDir_Comp
# Scope: Machine
# State: Enabled
# Source: Help.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System' -Name 'HelpQualifiedRootDir' -PropertyType 'String' -Value ''

These deployment candidates come from the ADMX template; they are separate from the native CSP mapping above.

The OMA-URI is an inferred ADMX-backed Policy CSP candidate derived from the source ADMX file name and policy name.
Some Microsoft policies use built-in Policy CSP pages whose area names don't match the ADMX file name, so verify the candidate against Microsoft Learn before deployment.
The generated payload is incomplete because one or more ADMX element values were not supplied: HelpQualifiedRootDir_Edit

ADMX profile candidate (OMA-URI)

./Device/Vendor/MSFT/Policy/Config/ADMX_Help/HelpQualifiedRootDir_Comp

Intune remediation scripts

Detection

$ErrorActionPreference = 'Stop'
$reasons = [System.Collections.Generic.List[string]]::new()

function Test-RegistryValueExists {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    return $null -ne (Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue)
}

function Test-RegistryValueEquals {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $Kind,
        [Parameter(Mandatory = $true)][object] $Expected
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return $false
    }

    $valueObject = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction SilentlyContinue
    if ($null -eq $valueObject) {
        return $false
    }

    $actual = $valueObject.$Name
    switch ($Kind) {
        'String' { return [string]$actual -ceq [string]$Expected }
        'ExpandString' { return [string]$actual -ceq [string]$Expected }
        'DWord' { return [uint32]$actual -eq [uint32]$Expected }
        'QWord' { return [uint64]$actual -eq [uint64]$Expected }
        'MultiString' {
            $actualArray = @($actual)
            $expectedArray = @($Expected)
            if ($actualArray.Count -ne $expectedArray.Count) { return $false }
            for ($index = 0; $index -lt $actualArray.Count; $index++) {
                if ([string]$actualArray[$index] -cne [string]$expectedArray[$index]) { return $false }
            }
            return $true
        }
        'Binary' {
            $actualArray = [byte[]]$actual
            $expectedArray = [byte[]]$Expected
            if ($actualArray.Length -ne $expectedArray.Length) { return $false }
            for ($index = 0; $index -lt $actualArray.Length; $index++) {
                if ($actualArray[$index] -ne $expectedArray[$index]) { return $false }
            }
            return $true
        }
        default { return [string]$actual -ceq [string]$Expected }
    }
}

# Policy: Restrict potentially unsafe HTML Help functions to specified folders
# Name: HelpQualifiedRootDir_Comp
# Scope: Machine
# State: Enabled
# Source: Help.admx

$isMatch = Test-RegistryValueEquals -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System' -Name 'HelpQualifiedRootDir' -Kind 'String' -Expected ''
if (-not $isMatch) {
    $reasons.Add('Value mismatch: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System\HelpQualifiedRootDir') | Out-Null
}

if ($reasons.Count -eq 0) {
    Write-Output 'Compliant'
    exit 0
}

$reasons | ForEach-Object { Write-Output $_ }
exit 1

Remediation

$ErrorActionPreference = 'Stop'

function Set-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name,
        [Parameter(Mandatory = $true)][string] $PropertyType,
        [Parameter(Mandatory = $true)][object] $Value
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        New-Item -Path $Path -Force | Out-Null
    }

    New-ItemProperty -LiteralPath $Path -Name $Name -PropertyType $PropertyType -Value $Value -Force | Out-Null
}

function Remove-RegistryValue {
    param(
        [Parameter(Mandatory = $true)][string] $Path,
        [Parameter(Mandatory = $true)][string] $Name
    )

    if (Test-Path -LiteralPath $Path) {
        Remove-ItemProperty -LiteralPath $Path -Name $Name -Force -ErrorAction SilentlyContinue
    }
}

function Clear-RegistryKeyValues {
    param(
        [Parameter(Mandatory = $true)][string] $Path
    )

    if (-not (Test-Path -LiteralPath $Path)) {
        return
    }

    foreach ($propertyName in (Get-Item -LiteralPath $Path).Property) {
        Remove-ItemProperty -LiteralPath $Path -Name $propertyName -Force -ErrorAction SilentlyContinue
    }
}

# Policy: Restrict potentially unsafe HTML Help functions to specified folders
# Name: HelpQualifiedRootDir_Comp
# Scope: Machine
# State: Enabled
# Source: Help.admx

Set-RegistryValue -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\System' -Name 'HelpQualifiedRootDir' -PropertyType 'String' -Value ''

History 5 retained releases

22H2 · 1.015 Jul 2024
- Already present in the first release ChangeIntel keeps.

4 later releases left it unchanged.

Template

Internal name: HelpQualifiedRootDir_Comp
Namespace: Microsoft.Policies.WindowsHelp
Template file: Help.admx
Release: Windows 11 25H2 · 1.0 · file set de4e49983ebd651f…

Definition, editor controls and support

Definition

<policy class="Machine" displayName="$(string.HelpQualifiedRootDir_Comp)" explainText="$(string.HelpQualifiedRootDir_Help)" key="Software\Policies\Microsoft\Windows\System" name="HelpQualifiedRootDir_Comp" presentation="$(presentation.HelpQualifiedRootDir_Comp)" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
      <parentCategory ref="Microsoft.Policies.Windows:System" />
      <supportedOn ref="Microsoft.Policies.Windows:SUPPORTED_IE6SP1" />
      <elements>
        <text id="HelpQualifiedRootDir_Edit" valueName="HelpQualifiedRootDir" />
      </elements>
    </policy>

Editor controls

<presentation id="HelpQualifiedRootDir_Comp" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">
        <textBox refId="HelpQualifiedRootDir_Edit">
          <label>Enter folder names separated by semi-colons:</label>
        </textBox>
        <text>Example: %windir%\Help;%windir%\pchealth;%programfiles%</text>
      </presentation>

Supported platforms and category

Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:definition:SUPPORTED_IE6SP1
<definition displayName="$(string.SUPPORTED_IE6SP1)" name="SUPPORTED_IE6SP1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
Microsoft.Policies.Windows:category:System
<category displayName="$(string.System)" explainText="$(string.System_Help)" name="System" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:System">System</string><string id="Microsoft.Policies.Windows:System_Help">Allows configuration of various system component settings.</string></strings>
Microsoft.Policies.Windows:definition:SUPPORTED_IE6SP1
<definition displayName="$(string.SUPPORTED_IE6SP1)" name="SUPPORTED_IE6SP1" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions" />
<strings><string id="Microsoft.Policies.Windows:SUPPORTED_IE6SP1">At least Internet Explorer 6 Service Pack 1</string></strings>