How to Block Downloads in Chrome and Edge

Downloads are a common way for malware to arrive and for data to leave. Chrome and Edge both support a DownloadRestrictions policy that can block dangerous files or all downloads entirely. This guide shows how to set it through the registry, explains what each value does, covers the limits, and shows how to enforce it consistently across a fleet.

What DownloadRestrictions controls

DownloadRestrictions is an enterprise policy that tells the browser how aggressively to block downloads. It ranges from doing nothing special to blocking every download.

Chrome and Edge share the same policy name but read it from different registry locations, so you set it per browser.

The values

The policy takes a numeric value that controls how strict the block is.

  • 0 - no special restrictions (default)
  • 1 - block downloads flagged as dangerous
  • 2 - block potentially dangerous and dangerous downloads
  • 3 - block all downloads
  • 4 - block malicious downloads

Limits and enforcement

DownloadRestrictions only covers the browser it is set in. A user who installs a different browser, or uses a portable one, sidesteps it - which is why browser control pairs well with application allowlisting.

A managed agent sets the right policy key for each installed browser, keeps it in place through updates, and can combine it with blocking unmanaged browsers, so the download block cannot simply be routed around.

Block downloads via the DownloadRestrictions policy

  1. Open Registry Editor - Press Win+R, type regedit, and press Enter.
  2. Set the Chrome policy - Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome (create the keys if missing) and add a DWORD named DownloadRestrictions set to 3 to block all downloads.
  3. Set the Edge policy - Go to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge and add a DWORD named DownloadRestrictions with the same value.
  4. Restart the browser - Close and reopen the browser so it re-reads policy. You can confirm it is applied by visiting chrome://policy or edge://policy.
  5. Verify - Try to download a file. It should be blocked, and chrome://policy or edge://policy should list DownloadRestrictions with your value.

Frequently asked questions

What value blocks all downloads?

Set DownloadRestrictions to 3 to block all downloads. Lower values block only dangerous or potentially dangerous files.

Do Chrome and Edge use the same policy?

They share the DownloadRestrictions policy name but read it from different registry paths - under Policies\Google\Chrome and Policies\Microsoft\Edge respectively.

Can a user bypass the download block?

By switching to an unmanaged or portable browser, yes. Pair the policy with application control so only managed browsers can run.

How do I confirm the policy is active?

Open chrome://policy or edge://policy in the browser. DownloadRestrictions should appear with the value you set and a status of OK.

Block risky downloads on every browser

CtrlOne sets download policies for Chrome and Edge, keeps them through updates, and blocks unmanaged browsers so the control can't be routed around.