For modern Windows 10 & 11 systems that do not support the legacy GPO approach, test the following for your environment.

1. An Updated XML (Classic Notepad)

To target the Classic (Win32) Notepad (C:\Windows\System32\notepad.exe) instead of the Microsoft Store version, you must use the Applications\notepad.exe ProgID.

File Name: SecurityAssociations.xml

<?xml version="1.0" encoding="UTF-8"?>
<DefaultAssociations>
  <!-- Scripting and Execution Host Extensions -->
  <Association Identifier=".js" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".jse" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".vbs" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".vbe" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".wsh" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".wsc" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".wsf" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".sct" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".hta" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  
  <!-- Shell and Legacy Shortcuts -->
  <Association Identifier=".shs" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".shb" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  
  <!-- Batch and Command Files -->
  <Association Identifier=".cmd" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".bat" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  
  <!-- Archives and Packages -->
  <Association Identifier=".cab" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
  <Association Identifier=".appx" ProgId="Applications\notepad.exe" ApplicationName="Notepad" />
</DefaultAssociations>

2. Steps for the Classic Notepad Product

On Windows 11, the system will try to push the UWP (Store) version of Notepad by default. To ensure the Classic version is used and respected by your GPO, follow these three steps:

Step A: Disable the "App Execution Alias" (Crucial for Win 11)

Windows 11 uses a "redirector" that points the command notepad.exe to the Store app. To force the classic one:

1. In your GPO, navigate to User Configuration > Preferences > Windows Settings > Registry.
2. Create a new Registry Item:

• Action: Replace
• Hive: HKEY_CURRENT_USER
• Key Path: Software\Microsoft\Windows\CurrentVersion\App Paths\notepad.exe
• Value name: (Default)
• Value type:REG_SZ
• Value data: C:\Windows\System32\notepad.exe

Step B: Deploy the XML via GPO

1. Save the XML referenced above to a network share accessible to all devices (e.g., \\Domain\NETLOGON\Security\SecurityAssociations.xml).
2. Open your GPO and go to: Computer Configuration > Administrative Templates > Windows Components > File Explorer
3. Enable: Set a default associations configuration file.
4. Enter the path to your XML file.

Step C: Disable the Modern Notepad (Optional but Recommended)

If you want to ensure the modern Store app doesn't interfere at all:

1. In the same GPO, go to: Computer Configuration > Administrative Templates > Windows Components > App Package Deployment

2. Use Prevent non-admin users from installing packaged Windows apps or specifically block the Notepad Package Family Name: Microsoft.WindowsNotepad_8wekyb3d8bbwe.

Legacy Windows

For legacy Windows environments you can create a GPO to test changing the default behavior of the following extensions to not behave as a script but rather as a benign text file opened in notepad.

js
wsh
vbs
wsc
sct
jse
wsf
shs
shb
hta
vbe
cmd
bat
cab
appx

Other extensions worth thinking of excluding if not needed for normal users.

chm (Windows help files)
iso
ps1

Legacy Group Policy Steps

The steps to do so are as follows in the Group Policy Management Console.

1. Switch to the GPO editing mode. In the GPO editor, go to the section User Configuration -> Preferences -> Control Panel Settings -> Folder Options.

2. Create a new parameter New -> Open With.

3. Fill the fields as follows:

• Action: Update
• File Extension: doc Associated Program: %windir%\system32\notepad.exe (or whichever appropriate) Set as default: check the option

4. The finished product should look similar to GPO.png.

It is important to test and roll this out slowly so as to not impact your production environment.

Side note: If you need to allow certain scripts to execute in your environment I would suggest that they be monitored while making non-RFC1918 connections and/or baselining accordingly.

But wait, there is more BONUS material: Leverage ASR to block some of these extensions in web/mail clients see MS ASR rules for more.