How to Enable or Disable Enhanced Security and Performance for batch and CMD files in Windows 11

Why Would You Want to Do This?

You might want to lock batch files when they’re in use to add an extra layer of security to your Windows 11 computer, preventing any accidental or malicious changes to scripts while they’re actively running.

Enhanced security for batch files in Windows 11 stops scripts from changing during execution. This protection prevents harmful code from altering running batch files. The feature helps keep your computer safe from malicious script modifications.

Enabling enhanced security and performance for batch files in Windows 11 requires a single file signature check per file. Without this mode, Windows checks each command's signature within a batch file individually. This single check significantly speeds up batch file processing and increases safety.

Policy authors can enable this mode by using the LockBatchFilesWhenInUse application manifest control, as documented in the Application Control for Business manifest schema.

What You Need

How to Enable or Disable This Feature

1. [ADMIN PRIVILEGES REQUIRED] Add the following value to the Windows registry:
   • Registry Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
   • Value name: LockBatchFilesWhenInUse
   • Type: DWORD
   • Data: Set to 0 (disabled) or 1 (enabled)

Turning the LockBatchFilesWhenInUse feature on or off in Windows 11 is straightforward and can be done using either the Windows registry editor or by running simple commands in the Command Prompt.

Enable:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v LockBatchFilesWhenInUse /t REG_DWORD /d 1 /f

Disable:

Windows 11 improves security and speed for batch and CMD files by preventing changes during execution. This prevents file tampering and also speeds up file loading. This protection feature, available in Windows 11, helps ensure file integrity.