Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Internet Explorer Processes

This policy controls the Internet Explorer security feature `FEATURE_RESTRICT_ACTIVEXINSTALL` for the Internet Explorer processes identified by the administrative template.

since 0.9.8.11

Purpose

Show registry keys (6)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\\Reserved
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\explorer.exe
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\iexplore.exe
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\\Reserved
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\explorer.exe
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL\iexplore.exe

This policy controls the Internet Explorer security feature FEATURE_RESTRICT_ACTIVEXINSTALL for the Internet Explorer processes identified by the administrative template. When the restriction is enabled, those processes block prompts to install ActiveX controls. This includes pages that instantiate an ActiveX control that is not installed or request installation of an updated control.

When the restriction is disabled, this policy does not block ActiveX installation prompts. If the policy is not configured, the user's preference determines whether the prompts are blocked.

Values under HKLM apply in the computer context, while the corresponding values under HKCU apply to the individual user. explorer.exe and iexplore.exe identify the processes to which the security feature applies. (Reserved) is a value name used by the administrative template and does not identify another process.

Notes

Security

Blocking installation prompts reduces the opportunity for users to install unwanted or unapproved ActiveX controls offered by websites. ActiveX controls can contain native code and, once installed, can access the system and user data within the permissions available to them.

This policy is not a general ActiveX prohibition. It does not remove controls that are already installed, categorically prevent their execution, or stop installation through other applications or deployment mechanisms. Other ActiveX, add-on, or application-control policies may govern those cases.

Possible side effects

Websites and legacy applications that need to install or update an ActiveX control on demand cannot provide the affected functionality when the required prompt is blocked. Existing business applications may therefore be impaired if they depend on an interactive first-time installation or update of a control.

Notes

The setting is process-specific. The value names supplied by the administrative template expressly target explorer.exe and iexplore.exe; they do not establish a system-wide restriction for every application that supports ActiveX or hosts the WebBrowser control.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP — RestrictActiveXInstallInternetExplorerProcesses

Microsoft Learn: INTERNETFEATURELIST enumeration — FEATURE_RESTRICT_ACTIVEXINSTALL

See also