Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled

This policy prevents Internet Explorer from falling back from Enhanced Protected Mode to regular Protected Mode so that an incompatible ActiveX control can run.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\DisableEPMCompat
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\DisableEPMCompat

This policy prevents Internet Explorer from falling back from Enhanced Protected Mode to regular Protected Mode so that an incompatible ActiveX control can run.

When the policy is enabled, Internet Explorer does not offer to disable Enhanced Protected Mode for a website that attempts to load an incompatible ActiveX control. Sites to which Protected Mode applies remain in Enhanced Protected Mode, and the incompatible control cannot be loaded.

When the policy is disabled or not configured, Internet Explorer can notify the user and offer to run the affected website in regular Protected Mode.

Notes

Security

The policy prevents an incompatible ActiveX control from triggering a user-approved reduction from Enhanced Protected Mode to regular Protected Mode. The additional restrictions of Enhanced Protected Mode therefore remain in effect. These restrictions include limiting the registry and file-system locations from which Internet Explorer can read.

This setting is not a blanket prohibition on ActiveX. Controls that support Enhanced Protected Mode and are permitted by the other Internet Explorer security settings can still run.

Possible side effects

Websites and line-of-business applications that depend on an ActiveX control incompatible with Enhanced Protected Mode might lose functionality because Internet Explorer no longer offers the regular Protected Mode fallback.

Notes

This policy does not enable Protected Mode or Enhanced Protected Mode. It has an effect only when Enhanced Protected Mode is already active.

It is an ADMX-backed policy available in both computer and user configuration. The HKLM value represents device-wide policy, while the HKCU value applies to the individual user.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – DoNotAllowActiveXControlsInProtectedMode

See also