How to Enable or Disable Enhanced Security and Performance for batch and CMD files in Windows 11

Why Would You Want to Do This?

You might want to lock batch files when they’re in use to add an extra layer of security to your Windows 11 computer, preventing any accidental or malicious changes to scripts while they’re actively running.

This feature makes batch files more secure. It stops batch files from changing while they’re running. This protects your computer from harmful code that tries to modify scripts during execution.

When you enable this mode, Windows only needs to check the file signature one time. Without this feature, Windows checks the signature for every single command in the batch file. This makes batch file processing faster and safer.

Policy authors can enable this mode by using the LockBatchFilesWhenInUse application manifest control, as documented in the Application Control for Business manifest schema.

What You Need

You must be signed in as an administrator to turn on or off this setting.

How to Enable or Disable This Feature

1. [ADMIN PRIVILEGES REQUIRED] Add the following value to the Windows registry:
   • Registry Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor
   • Value name: LockBatchFilesWhenInUse
   • Type: DWORD
   • Data: Set to 0 (disabled) or 1 (enabled)

Turning the LockBatchFilesWhenInUse feature on or off in Windows 11 is straightforward and can be done using either the Windows registry editor or by running simple commands in the Command Prompt.

Enable:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v LockBatchFilesWhenInUse /t REG_DWORD /d 1 /f

Disable:

reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor" /v LockBatchFilesWhenInUse /t REG_DWORD /d 0 /f

Summary

Windows 11 lets you add better security and speed to batch and CMD files by stopping them from changing while they run, which also makes them load faster.