🛡️ Disable Windows Script Host (WSH) for Better Endpoint Protection Using Intune
Windows Script Host (WSH) has been a part of the Windows operating system since the late 1990s, providing the ability to run VBScript and JScript files. While it serves some legacy administrative and scripting purposes, WSH is rarely used in modern enterprise environments and is frequently exploited in cyberattacks.
In this post, I’ll walk you through:
✅ Why disabling WSH improves security
✅ How to disable WSH using Intune PowerShell scripts
✅ A step-by-step guide with screenshots
1 - Why You Should Disable Windows Script Host (WSH) ❓
WSH enables execution of .vbs and .js scripts, which are often leveraged by attackers to :
Deliver ransomware payloads
Drop additional malware
Bypass traditional antivirus tools
Run fileless malware directly in memory
📌 Most modern organizations no longer use WSH for legitimate purposes. Leaving it enabled unnecessarily increases your attack surface.
Disabling WSH helps block many common phishing and malware-based attacks, especially those embedded in malicious email attachments or delivered via compromised websites.
2 - Disable WSH via Microsoft Intune
To deploy this security setting across your Windows 10 and 11 devices, we will use Intune PowerShell scripts.
The following registry modification disables WSH system-wide, so save it in ps1 file, we'll use it in the following configuration section with Intune :
3 - Step-by-Step Deployment with Microsoft Intune
Go to Microsoft Intune Admin Center
Navigate to: https://intune.microsoft.com
Click Devices
Select Scripts and Remediations
Select the Platform scripts tab
Click + Add > Windows 10 and later
Configure Script Basics
Enter a name like: Disables Windows Script Host
Optional: Add a description
Click Next
Upload the PowerShell Script
Upload your .ps1 script file
Configure settings as follows :
Run this script using the logged on credentials : No
Enforce script signature check : No
Run script in 64-bit PowerShell Host : No
Click Next
Assign to Device Groups
Assign the script to All devices or a specific group of your choice
Click Next
Review + Create
Review your configuration
Click Create to deploy
4 - Result
Once deployed, this script ensures that WSH is disabled via the registry on all targeted Windows devices. Users (or malware) attempting to run .vbs or .js files will receive an error such as :
"Windows Script Host access is disabled on this machine. Contact your administrator for details."
If we check Registry path in our previous PowerShell script, we'll see a new registry key "Enabled" with value = 0.
🔒 Final Thoughts
Disabling WSH is a simple yet powerful way to reduce attack vectors across your Windows fleet. Combined with other hardening measures (ASR rules, Smart App Control, etc.), this policy adds a layer of protection against script-based threats.
🔁 Roll it out with confidence using Intune and stay one step ahead of attackers.
Thanks
Aymen EL JAZIRI
System Administrator
Senior System Administrator & IT-Technician
1moAgain such an interesting article. Thank you Aymen E. 🙏🏻
Semi-retired. Open to 100% Remote Only Contracts, Staff Augumentation in the following areas: | Windows Application Packager | Windows Deployment Engineer | Microsoft Endpoint Management
2moAlthough most companies no longer use WScript and the associated script languages, VBScript and JScript, the number is not zero. Therefore, before implementing enterprise-wide, careful testing is necessary to identify any line-of-business legacy applications that may still be in production. Fortunately, your solution can be used to target selective groups of devices for testing. Although the image deployment system, MDT, is appreciated, it is still widely used by many companies and utilizes VBScript. Additionally, it is used by HTA, which are scarce apps, but you never say never. One question: If you applied the policy in testing, did you discover an app that required a script? Having a policy to reverse the change might be prudent to have ready. Do you know if disabling the original policy automatically reinstates the default setting? This ChatGPT response below indicates that it would not. What happens when you disable or remove a Custom OMA-URI policy? Disabling or deleting a Custom OMA-URI does NOT revert the registry setting to its previous value. Intune does not "roll back" registry changes made via Custom OMA-URI unless you explicitly create a new policy to undo the change.