Registry Policy Reference

This reference contains the registry keys and values used to manage, secure, and configure NVM for Windows in enterprise environments.

All administrative policies should be enforced within the HKEY_LOCAL_MACHINE (HKLM) hive. Settings applied here are mandatory and will override any conflicting preferences configured by individual users within the local application interface.

Policy Override Behavior

The application evaluates settings in the following order of priority. Policies beat Preferences in the same hive. HKLM beats HKCU.

1. HKLM\Software\Policies\Author Software\nvm (machine policy — GPO / Intune / ADMX)
2. HKLM\Software\Author Software\Preferences\nvm (machine preferences)
3. HKCU\Software\Policies\Author Software\nvm (user policy)
4. HKCU\Software\Author Software\Preferences\nvm (user preferences — nvm config)

Available Registry Keys

See Administrative Templates for GPO and Intune deployment. Download ADMX/ADML from the customer portal. ADMX/ADML ship with the Governance pack. Values under HKLM\Software\Policies\Author Software\nvm are enforced only with a Governance license (licensing secrets excepted).

Overridable in a description means users may also set the equivalent preference (nvm config / HKCU). Machine policy under HKLM\Software\Policies\Author Software\nvm always wins.

Name	Key	Description
Air-gapped license verify	AirGapped	Edition: Distro+. Skip live JWKS fetch from licensing.author.io. Verify AccessToken only against the COSE-signed offline JWKS store (JwksCose or nvm-jwks.cose next to nvm.exe). Independent of LocalInstallOnly. When on and no trusted malware.db exists (live pair and Certified Program Files seed both missing or untrusted), the shim skips malware scans. Certified MSI ships a build-time seed; live feed still preferred. An untrusted malware.db does not replace a valid seed. - 0 = off - 1 = on Default: 0 REG_DWORD
Version aliases	Aliases	Overridable. Centrally managed aliases (e.g. stable=24.9.0). Blocks user-defined aliases when set by policy. alias=version per entry REG_MULTI_SZ
Allow cache deletion	AllowDownloadCacheDelete	Overridable (allow_download_cache_removal). Whether cached downloads may be removed (nvm cache remove). - 0 = blocked - 1 = allowed Default: 1 REG_DWORD
Allow insecure downloads	AllowInsecureDownloads	Overridable (allow_insecure_downloads). Permit downloads when TLS certificates are expired or invalid. - 0 = blocked - 1 = allowed Default: 0 REG_DWORD
Allow install root change	AllowRootDirChange	Overridable. Whether users may change the install root. - 0 = blocked - 1 = allowed Default: 1 REG_DWORD
Allow native tool install	AllowToolInstall	Overridable. Allow nvm install native-tools (Python, VS Build Tools, etc.) (shim-only). - 0 = blocked - 1 = allowed Default: 1 REG_DWORD
Allowed code signers	AllowedSigners	Overridable (allowed_signers). Additional trusted node.exe signers. OpenJS Foundation, Node.js Foundation, and Author Software are always trusted (shim-only). One signer name per entry. REG_MULTI_SZ
Allowed thumbprints	AllowedThumbprints	Overridable (allowed_thumbprints). Optional SHA-1 Authenticode leaf thumbprints (hex; separators optional). When non-empty, node.exe must match a pin after org allowlist. Empty disables pinning. REG_MULTI_SZ
Authenticode revocation	AuthenticodeRevocation	Overridable (authenticode_revocation). CRL/OCSP mode for Authenticode: - online = network retrieval (install/sign/seed only; default) - cached = local URL cache only - disabled = no revocation checks Shim runtime never uses online (clamped to cached). AirGapped forces cached when online would apply. Default: online REG_SZ
Auto-detect files	AutoDetect	Overridable (auto_detect). Project files scanned for version pins (shim-only). Overrides defaults. Default:   .nvmrc   .node-version   package.json REG_MULTI_SZ
Auto-install missing version	AutoInstall	Overridable (auto_install). Auto-install missing detected versions (shim mode). - 0 = off - 1 = on Default: 0 REG_DWORD
Auto-install global modules	AutoInstallModuleList	Overridable (auto_installed_modules). Global npm modules installed with each new Node.js version. One module name per entry. REG_MULTI_SZ
Prompt before auto-install	AutoInstallPrompt	Overridable (auto_install_prompt). Confirm before auto-installing (shim mode). - 0 = no prompt - 1 = prompt Default: 1 REG_DWORD
Auto-use detected version	AutoUse	Overridable (auto_use). Auto-switch to detected version when running commands (shim mode). - 0 = off - 1 = on Default: 1 REG_DWORD
Cache downloads	CacheDownloads	Overridable (cache_downloads). Cache downloaded Node.js versions for offline reuse. - 0 = off/false - 1 = on/true Default: 0 REG_DWORD
Default detect file	DefaultDetectFile	Overridable (default_detect_file). File written when pinning a version (nvm pin) (shim-only). Default: .nvmrc REG_SZ
Disable announcements	DisableAnnouncements	Overridable (disable_announcements). Suppress project and release announcements. - 0 = shown - 1 = hidden Default: 0 REG_DWORD
Disallow eval/string code gen	DisableEvalAndStringExecution	Overridable (disable_eval_and_string_execution). Node shim prepends --disallow-code-generation-from-strings, blocking eval() and new Function() (shim-only). When 1, the package-manager proxy also merges this flag into npm_config_node_options for npm/npx/pnpm lifecycle scripts. Yarn, bun, corepack, and vlt are not covered. Does not set NODE_OPTIONS. Does not affect node:vm. - 0 = off (no env write) - 1 = on Default: 0 REG_DWORD
Disable NVM upgrades	DisableUpgrade	Overridable. Block in-app NVM upgrades (does not block AD/GPO package deployment). - 0 = allowed - 1 = blocked Default: 0 REG_DWORD
Disable version management	Enabled	Overridable (nvm on/nvm off). Forces version management on or off. When off, NVM does not manage or redirect Node.js commands. - 0 = off (nvm off) - 1 = on Default: 1 REG_DWORD
Enforce permission model	EnforcePermissionModel	Overridable (enforce_permission_model). Node shim prepends Node permission-model flag on node launches (shim-only). When 1, the package-manager proxy also merges the same flag and DefaultPermissionGrants into npm_config_node_options for npm/npx/pnpm lifecycle scripts. npm-cli.js itself is not launched under --permission. Yarn, bun, corepack, and vlt are not covered. Does not set NODE_OPTIONS. Default-deny FS/network unless the process passes --allow-* at runtime. NVM does not inject --allow-* grants except DefaultPermissionGrants. NVM never injects --permission-audit (Node 25.8+ report-only). There is no policy that forces --permission-audit. - Node 23+: --permission - Node 20–22: --experimental-permission - Node <20: no flag (unsupported) - HKLM Policies 1: strip caller --permission-audit (argv, NODE_OPTIONS, and npm_config_node_options) and inject --permission / --experimental-permission. Filter --allow-* even if the caller already passed --permission. - Preference-only 1: caller --permission-audit is a debug exception for node (no inject). Proxy still merges --permission into npm_config_node_options without stripping existing tokens. - 0 = off (no env write) - 1 = on Default: 0 REG_DWORD
Permission grant audit	PermissionGrantAudit	Overridable (permission_grant_audit). Shim-only. Writes Event Log fields for permission grants; does not pass Node’s --permission-audit and does not change whether Node denies access. When 1, or when EnforcePermissionModel is on, the node shim writes one nodejs.permission_grants event when the caller passed --allow-* / a permission-model flag, or when policy applied or removed allow flags (permission_allow.supplied / .applied / .removed). The same object is added to nodejs.executed when LogExecutions is on. A failed event write still starts Node.js. - 0 = off - 1 = on Default: 0 REG_DWORD
Default permission grants	DefaultPermissionGrants	Overridable (default_permission_grants). Shim-only. One argv token per line (for example --allow-fs-read=*). Inserted immediately after the permission flag when EnforcePermissionModel injects --permission / --experimental-permission (and when HKLM Policies forces that policy even if the caller already passed --permission). Skips a token the caller already passed. Same tokens merge into npm_config_node_options for npm/npx/pnpm when the permission flag is injected. Do not list --permission-audit (ignored; never injected). Empty by default — NVM ships no built-in grants. REG_MULTI_SZ
Allowed permission grants	AllowedPermissionGrants	Overridable (allowed_permission_grants). Shim-only. Used only when EnforcePermissionModel injects the permission flag. When this list has one or more lines, the shim removes caller --allow-* tokens that are not listed. One argv token per line. Empty leaves caller --allow-* unchanged. DefaultPermissionGrants are not filtered by this list. REG_MULTI_SZ
Freeze V8 global objects	FreezeV8GlobalObjects	Overridable (freeze_v8_global_objects). Node shim prepends --frozen-intrinsics so built-in prototypes cannot be patched (shim-only; Node.js 12+). When 1, the package-manager proxy also merges this flag into npm_config_node_options for npm/npx/pnpm lifecycle scripts. Yarn, bun, corepack, and vlt are not covered. Does not set NODE_OPTIONS. Adds measurable startup cost. - 0 = off (no env write) - 1 = on Default: 0 REG_DWORD
Install root	InstallRoot	Overridable (root). Directory where Node.js version trees are stored. Runtime dirs (.shim, .nodejs, .sync, .cache, .verify) stay under the program root, not the parent of this path. Overrides machine and user preferences. Default: %LOCALAPPDATA%\Author Software\nvm\installs. That directory is writable by the installing user. Other users cannot write it (NVM4305). Set this key to a locked directory when versions must be immutable (Governance). REG_SZ
Local install source	LocalInstallDir	Overridable (local_dir). Alternate local directory for Node.js archives (air-gapped mirrors). Overrides cache. REG_SZ
Local install only	LocalInstallOnly	Overridable (local_install_only). Restrict installs to LocalInstallDir only. - 0 = off - 1 = on Default: 0 REG_DWORD
Audit logging	LogExecutions	Overridable (log_executions). Log every Node.js invocation to the Windows Event Log (shim-only). Most useful on Audit+ (structured ETW). - 0 = off - 1 = on Default: 0 REG_DWORD
Skip malware checks	SkipMalwareChecks	Overridable (skip_malware_checks). Skip malware checks for package-manager and node shims. The definition file still updates. HKLM wins over HKCU. AirGapped with no trusted malware.db also skips, without this key. - 0 = check - 1 = skip Default: 0 REG_DWORD
Wrap bun for malware checks	ShimBun	Overridable (shim_bun). Wrap bun and bunx so OpenSSF malware checks run when bun is used as a package manager. NVM for Windows does not install bun and does not switch bun versions. HKLM wins over HKCU. - 0 = no bun shims - 1 = create {DataRoot}/.shim/bun.exe and bunx.exe Default: 0 Community, 1 Certified Builds REG_DWORD
Notify malware definitions	NotifyMalwareDefinitions	Overridable (notify_malware_definitions). Certified only. Silent toast after definitions change. HKLM can force it off. - 0 = hide - 1 = show Default: 1 REG_DWORD
Malware allow list	MalwareAllowList	HKLM only. Patterns that clear an OpenSSF hit. Byte-for-byte. A * clears every OpenSSF hit. Does not clear an organization block. Empty allows nothing. REG_MULTI_SZ
Malware block list	MalwareBlockList	Certified only. HKLM patterns that always block, or one https:// policy URL. Community builds ignore this list. REG_MULTI_SZ
Malware trust conflict	MalwareTrustConflict	Certified only. Overridable (malware_trust_conflict). prevent (default) blocks a trusted or approved OpenSSF hit. continue lets that explicit trust or approval through. HKLM wins over HKCU. REG_SZ
Node.js download mirrors	MirrorNode	Overridable (node_mirror). Ordered mirror list; first successful response wins. See Download Mirrors. Author *.author.io mirrors need Governance licensing — see Version Firewall + Author Mirror. Default: https://nodejs.org/dist REG_MULTI_SZ
npm registry mirrors	MirrorNpm	Overridable (npm_mirror). Ordered npm registry list. Used as shim registry fallback. Default: https://registry.npmjs.org REG_MULTI_SZ
Operating mode	OperatingMode	Overridable (mode). How NVM for Windows manages Node.js versions. Shim (recommended) uses signed shims to intercept node, npm, npx, yarn, pnpm, and (when ShimBun is on) bun / bunx. Required for runtime policies (audit logging, auto-detect, ACL). Link uses NTFS junctions/symlinks on PATH. Default: shim REG_SZ
Package manager mismatch action	PackageManagerMismatchAction	Overridable (pm_mismatch_action). Behavior when npm/pnpm/yarn version mismatches Node during install or use (shim-only). - ignore - warn - error Default: error REG_SZ
Proxy URL	Proxy	Overridable (proxy). Proxy for downloads. Basic and Bearer work on all certified editions. See HTTP Proxy. REG_SZ
Proxy auth value	ProxyAuth	Overridable (proxy_auth). Credentials or bearer token (stored in plain text). - user:pass - Bearer YOUR_TOKEN REG_SZ
Proxy auth type	ProxyAuthType	Overridable (proxy_auth_type). Authentication scheme for the configured proxy. - basic, bearer — all certified editions - ntlm, negotiate, ntlm,negotiate — Governance only (IWA); PAC/WPAD also Governance-only REG_SZ
Catalog fetch deadline	TimeoutCatalogMs	Overridable. Maximum milliseconds for the Node.js version catalog fetch across all mirrors. Exceeding the budget can surface as NVM4501. Default: 3000 REG_DWORD
Catalog mirror deadline	TimeoutCatalogMirrorMs	Overridable. Maximum milliseconds for one catalog mirror attempt. Default: 800 REG_DWORD
Download-source check deadline	TimeoutReachabilityMs	Overridable. Maximum milliseconds for each download-source reachability check in nvm env. Default: 1500 REG_DWORD
Download deadline	TimeoutDownloadMs	Overridable. Maximum milliseconds for archive, checksum, and other downloads. Doctor deadline measurements use this budget. Default: 30000 REG_DWORD

Governance Keys

These keys appear in the Governance ADMX pack. The Policies hive (including version/module firewall lists) is enforced only when Governance is licensed.

Name	Key	Description
Verbose mirror license metadata	ApplyVerboseLicenseMetadata	When on, Author mirror license JWTs include identity claims (idp_username, idp_machine_name, idp_machine_id). Does not set AccessToken/AccessKey. - 0 = omit claims - 1 = include claims Default: 0 REG_DWORD
Verbose firewall policy metadata	ApplyVerboseFirewallMetadata	When on, HTTPS firewall policy JWTs include verbose identity claims (idp_*) plus npm/pnpm/yarn profile/config when available. - 0 = omit extra claims - 1 = include claims Default: 0 REG_DWORD
Skip lockfile for module firewall	FirewallSkipLockfile	When on, module firewall uses package.json only (ignores lockfiles for local matching and HTTPS POST bodies). - 0 = use lockfile when present (default) - 1 = skip lockfile REG_DWORD
Firewall HTTPS policy timeout	FirewallHTTPTimeoutSeconds	Timeout in seconds for HTTPS ApprovedModules / TrustedModules policy POST requests. Fail closed on timeout. Default: 3 REG_DWORD
Trusted firewall TLS organizations	TrustedFirewallSigners	Optional O= organization allow list for HTTPS firewall policy endpoints. Empty accepts any certificate that passes normal TLS validation. One organization per entry. REG_MULTI_SZ
Trusted firewall TLS thumbprints	TrustedFirewallThumbprint	Optional SHA-1 leaf certificate thumbprint pins for HTTPS firewall policy endpoints. Empty disables pinning. One thumbprint per entry. REG_MULTI_SZ
npm module minimum age	NpmModuleMinimumAge	Minimum package publish age (cooldown), in minutes, for package manager installs (shim mode). Auto-converts for npm/npx/pnpm/yarn (min-release-age / env), vlt (VLT_BEFORE UTC ISO-8601 cutoff = now − minutes), and bun/bunx (--minimum-release-age in seconds = minutes × 60; requires ShimBun). corepack is not covered. Default: Community 0 (disabled) — same as stock npm/npx with no version manager. Certified Builds 2880 (2 days) when the key is unset, including npx, vlt, and bun when shimmed. nvm config and CLI age overrides (--min-release-age, vlt --before, bun --minimum-release-age) still override the Certified default when the key is not forced. When HKLM Policies sets this key, the value is forced and the shim strips --min-release-age, --minimum-release-age, --minimum-release-age-excludes, --config.min-release-age, --before, --no-time-gate, and --bypass-age-policy (arguments after -- stay). DWORD 0 forces the gate off. REG_DWORD
Block package manager lifecycle scripts	BlockPackageManagerLifecycleScripts	HKLM Policies only (not overridable; no nvm config / HKCU preference). Shim mode only. When 1, the package-manager proxy blocks install-class lifecycle scripts (preinstall / install / postinstall / prepare) by injecting --ignore-scripts for npm/npx/pnpm/vlt/bun/bunx (and Yarn 1) and YARN_ENABLE_SCRIPTS=false for Yarn 2+. Command-line attempts to turn scripts back on are removed. Explicit npm run … still runs (stock npm). A project .npmrc cannot undo this lock. This is the same capability developers can apply voluntarily with --ignore-scripts; Governance forces it fleet-wide. See Lifecycle scripts vs stock npm. Certified Builds with Advanced Logging write NVM4412 when an install-class command is rewritten. Community and Certified without that add-on still apply the lock without that event. - 0 = off - 1 = on Default when unset: 0 REG_DWORD
Trusted modules (self-update reshim)	TrustedModules	Shim mode. Global CLI modules trusted to auto-reshim after they rewrite their own entrypoints (self-update). Use NOT/! negation. Empty defaults to NOT ALL. A single https:// URL enables remote policy evaluation. Also configurable with nvm firewall trust (Community and Certified). HKLM Policies forces the list under Governance. REG_MULTI_SZ
Approved modules (local installs)	ApprovedModules	Certified Builds. Shim mode. Allow list for local package-manager installs (npm/pnpm/yarn/npx). Empty defaults to ALL. Supports name, @org/*, version pins/ranges, NOT/! negation, or a single https:// policy URL. See NVM Firewall. REG_MULTI_SZ
Approved global modules	ApprovedGlobalModules	Certified Builds. Shim mode. Allow list for global package-manager installs. Empty defaults to ALL. Same rule syntax as ApprovedModules. REG_MULTI_SZ
Untrusted module change action	UntrustedModuleHandlerAction	Shim mode. When a global module changes and is not on TrustedModules: - deny (default) — skip reshim - prompt — console or Trust/Cancel toast - allow — auto-reshim with a quiet toast REG_SZ
Allowed Node.js versions	VersionAllowList	Governance. Allow list for nvm install, nvm use, and the shim. Ignored without a Governance license. Invalid entries fail enforcement. Allow wins over block when both lists come from the same source. The shim loads allow and block as a pair from HKLM Policies when Governance is active. Also feeds Author-mirror JWT version claims (magic tokens such as EOL, ALPHA, MAINTENANCE, ALL). Those magic tokens are ignored locally at install, use, and shim launch. Supports exact semver, wildcards (e.g. 20.x), aliases, and NOT/! negation (one rule per line). REG_SZ
Blocked Node.js versions	VersionBlockList	Governance. Block list for nvm install, nvm use, and the shim. Same rule formats and pairing as VersionAllowList. Ignored without Governance. REG_SZ

License secrets

AccessToken, AccessKey, and JwksCose are not ADMX policies. Deploy with portal scripts (Set-NvmWindowsAccessToken.ps1 on stock certified build; Set-NvmWindowsLicensing.ps1 for governance builds, which also sets AccessKey for Author mirrors) or nvm license.

GPO vs registry values

Several ADMX policies use inverted GPO labels (e.g. Disable automatic version detection writes AutoUse=0 when enabled). The tables document the registry value admins should deploy via GPO, Intune (imported ADMX or Registry CSP), or Entra custom OMA-URI.

Registry Import Example

Save as nvm-policy.reg, replace placeholder paths and URLs for your environment, then double-click or run reg import nvm-policy.reg from an elevated command prompt.

REG_MULTI_SZ keys

MirrorNode, MirrorNpm, Aliases, AutoDetect, AutoInstallModuleList, AllowedSigners, AllowedThumbprints, DefaultPermissionGrants, AllowedPermissionGrants, TrustedModules, ApprovedModules, ApprovedGlobalModules, TrustedFirewallSigners, and TrustedFirewallThumbprint are REG_MULTI_SZ (one string per entry). A .reg line like "MirrorNode"="url1,url2" creates a wrong REG_SZ. Set those with ADMX, Registry CSP, or PowerShell (below) — not comma-joined REG_SZ values.

Windows Registry Editor Version 5.00

; =============================================================================
; NVM for Windows — machine policy (HKLM)
; Path: HKLM\SOFTWARE\Policies\Author Software\nvm
; =============================================================================

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Author Software\nvm]

; --- Core / environment ---
"OperatingMode"="shim"
"Enabled"=dword:00000001
"InstallRoot"="%LOCALAPPDATA%\\Author Software\\nvm\\installs"
"AllowRootDirChange"=dword:00000000
"LocalInstallDir"="D:\\Node\\local_mirror"
"LocalInstallOnly"=dword:00000000
"AirGapped"=dword:00000000

; --- Version ACL (Governance) ---
"VersionAllowList"="20.x\r\n22.x"
"VersionBlockList"="!20.17.0"

; --- Network / downloads (SZ / DWORD only here; MULTI_SZ via PowerShell below) ---
"Proxy"="http://proxy.example.corp:8080"
"ProxyAuthType"="ntlm"
; "ProxyAuth"="service-account:password"
; "ProxyAuth"="Bearer YOUR_TOKEN_HERE"
"CacheDownloads"=dword:00000001
"AllowDownloadCacheDelete"=dword:00000000
"AllowInsecureDownloads"=dword:00000000
"ApplyVerboseLicenseMetadata"=dword:00000000
"ApplyVerboseFirewallMetadata"=dword:00000000
"FirewallSkipLockfile"=dword:00000000
"DisableUpgrade"=dword:00000001
"DisableAnnouncements"=dword:00000001
"SkipMalwareChecks"=dword:00000000
"ShimBun"=dword:00000001
"NotifyMalwareDefinitions"=dword:00000001
"MalwareTrustConflict"="prevent"

; --- Shim runtime (requires OperatingMode=shim) ---
"DefaultDetectFile"=".nvmrc"
"AutoUse"=dword:00000001
"AutoInstall"=dword:00000000
"AutoInstallPrompt"=dword:00000001
"AllowToolInstall"=dword:00000000
"PackageManagerMismatchAction"="error"
"LogExecutions"=dword:00000001
"EnforcePermissionModel"=dword:00000001
"FreezeV8GlobalObjects"=dword:00000001
"DisableEvalAndStringExecution"=dword:00000001
"NpmModuleMinimumAge"=dword:00000b40
"BlockPackageManagerLifecycleScripts"=dword:00000001
"PermissionGrantAudit"=dword:00000000
"TimeoutCatalogMs"=dword:00000bb8
"TimeoutCatalogMirrorMs"=dword:00000320
"TimeoutReachabilityMs"=dword:000005dc
"TimeoutDownloadMs"=dword:00007530
"FirewallHTTPTimeoutSeconds"=dword:00000003
"UntrustedModuleHandlerAction"="deny"

After importing the .reg (or instead of it for list values), set multi-string keys elevated:

$policy = 'HKLM:\SOFTWARE\Policies\Author Software\nvm'

New-ItemProperty -Path $policy -Name MirrorNode -PropertyType MultiString -Force -Value @(
  'https://mirror.author.io/runtime/nodejs'
  'https://nodejs.org/dist'
) | Out-Null

New-ItemProperty -Path $policy -Name MirrorNpm -PropertyType MultiString -Force -Value @(
  'https://npm.example.corp'
  'https://registry.npmjs.org'
) | Out-Null

New-ItemProperty -Path $policy -Name Aliases -PropertyType MultiString -Force -Value @(
  'stable=24.9.0'
  'lts=22.17.0'
) | Out-Null

New-ItemProperty -Path $policy -Name AutoDetect -PropertyType MultiString -Force -Value @(
  '.nvmrc'
  '.node-version'
  'package.json'
) | Out-Null

New-ItemProperty -Path $policy -Name AutoInstallModuleList -PropertyType MultiString -Force -Value @(
  'typescript'
  'eslint'
  'prettier'
) | Out-Null

New-ItemProperty -Path $policy -Name AllowedSigners -PropertyType MultiString -Force -Value @(
  'Contoso Ltd.'
) | Out-Null