How to Block Untrusted Fonts in Windows 11

What Are Fonts and Untrusted Fonts?

Typography styles define how text appears on screen. Untrusted fonts originate outside the official Windows directory, frequently hiding on unverified third-party websites.

Loading unverified typefaces from external locations can compromise operating system stability and open security vulnerabilities.

Why Block Untrusted Fonts?

Adversaries occasionally leverage rogue font files to execute malicious code on target machines. Windows 11 includes a native protection mechanism called Blocking Untrusted Fonts that intercepts these files before they execute.

How to Control Untrusted Fonts in 🪟 Windows 11

System administrators can configure this feature in multiple ways depending on monitoring requirements. Choosing the 'On' setting blocks unsafe fonts and records attempts to use them, whereas the 'Audit' setting only logs these attempts without blocking execution.

• On – Blocks unsafe fonts from loading outside the trusted font folder and records these events.
• Audit – Does not block fonts but keeps a log of apps that use untrusted fonts.
• Exclude apps – Lets you allow certain apps to use untrusted fonts, even if blocking is on.

Method 1Use the Local Group Policy Editor

The Block Untrusted Fonts security feature in Windows 11 lets administrators control which typefaces load into memory. Press Windows + R to open the Run dialog, type gpedit.msc, and press Enter. Note that this method works exclusively on Windows 11 Pro and Enterprise editions.

1. Press Windows key + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor. (If you don't know how to open it, see this guide: How to open Local Group Policy Editor)
2. In the editor, go to: Computer Configuration > Administrative Templates > System > Mitigation Options
3. On the right side, find and double-click Untrusted Font Blocking.
4. Choose one of these options:

   • Not Configured (default) – No fonts are blocked.
   • Enabled – Blocks untrusted fonts and logs events.
   • Disabled – Same as Not Configured, no fonts are blocked.
5. Click OK to save your changes and close the window.

Method 2Use the Windows Registry Editor

Editions lacking the Group Policy Editor, such as Windows Home, require the Registry Editor to configure this protection. Modifying the registry mandates administrative privileges. Press the Windows key + R, type regedit, and press Enter to launch the editor.

1. ⚠️ Requires admin privileges – Press Windows key + R, type regedit, and press Enter to open the Registry Editor. (If you need help, see: How to open Windows Registry Editor)
2. In Registry Editor, go to this folder: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\MitigationOptions
3. If you don't see the MitigationOptions folder, right-click Windows NT, select New > Key, and name it MitigationOptions.
4. Right-click on the right side of the MitigationOptions folder and select New > DWORD (32-bit) Value.
5. Name this new value: MitigationOptions_FontBlocking
6. Double-click this new value to edit it. Set the base to Hexadecimal and use one of these values:

   • 1000000000000 – Turn on blocking.
   • 2000000000000 – Turn off blocking.
   • 3000000000000 – Audit only (log events, don't block).
7. Click OK and close the Registry Editor.
8. Restart your computer for the changes to take effect.

Summary

• Blocking untrusted fonts helps protect your Windows 11 PC from harmful files.
• You can control this setting using either the Local Group Policy Editor or the Registry Editor.
• Choose to block, audit, or allow untrusted fonts based on your needs.
• Remember to restart your PC after making changes.
• If you want to learn more about fonts on Windows 11, check out this easy guide on how to install fonts in Windows 11.

Stopping untrusted fonts from loading protects your hardware from malicious payloads. Depending on your Windows edition, managing this feature requires either the Local Group Policy Editor or the Registry Editor. Reboot the workstation after applying configuration updates to ensure the changes take effect.

Microsoft - Block Untrusted Fonts

Leave a comment below to share feedback or ask questions about the configuration process.