Policy
Block loading of COM/VSTO add-ins registered in HKCU
This policy setting controls whether COM/VSTO add-ins registered only in HKEY_CURRENT_USER (HKCU) are blocked from loading. Standard users can install add-ins through ClickOnce deployment or the Office Add-ins settings, which typically register add-ins in HKCU rather than HKEY_LOCAL_MACHINE (HKLM). If you enable this policy setting, all COM/VSTO add-ins registered only in HKCU will be blocked from loading, preventing users from running add-ins they have installed without administrator privileges. If you disable or don't configure this policy setting, COM/VSTO add-ins registered in HKCU are allowed to load normally. Note: Add-ins registered in HKLM (typically installed by administrators) are not affected by this policy setting.
4e5a36f7ed46 L_RestrictCUCOMAddin Registry
Copy registry mappings
HKCU\software\policies\microsoft\office\16.0\common\security\restrictcucomaddin (enabled) = 1
HKCU\software\policies\microsoft\office\16.0\common\security\restrictcucomaddin (disabled) = 0Policy notes
This policy setting controls whether COM/VSTO add-ins registered only in HKEY_CURRENT_USER (HKCU) are blocked from loading. Standard users can install add-ins through ClickOnce deployment or the Office Add-ins settings, which typically register add-ins in HKCU rather than HKEY_LOCAL_MACHINE (HKLM). If you enable this policy setting, all COM/VSTO add-ins registered only in HKCU will be blocked from loading, preventing users from running add-ins they have installed without administrator privileges. If you disable or don't configure this policy setting, COM/VSTO add-ins registered in HKCU are allowed to load normally. Note: Add-ins registered in HKLM (typically installed by administrators) are not affected by this policy setting.