Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the Internet Explorer `FEATURE_RESTRICT_FILEDOWNLOAD` security feature for Windows Explorer and Internet Explorer processes.

since 0.9.8.11

Purpose

Show registry keys (6)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\(Reserved)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\explorer.exe
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\iexplore.exe
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\(Reserved)
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\explorer.exe
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD\iexplore.exe

This ADMX-backed Group Policy setting controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature for Windows Explorer and Internet Explorer processes. The feature applies to file downloads that were not explicitly initiated by a user action such as a mouse click or key press.

When the policy is enabled, the affected processes block prompts for such downloads. When it is disabled, downloads that were not initiated by the user may produce a prompt. If the policy is not configured, the user's preference determines whether the prompt is shown.

This setting is not a comprehensive download prohibition. It does not, by itself, block downloads deliberately initiated by the user or download mechanisms operating outside the processes covered by the feature.

Notes

Security

Blocking unsolicited download prompts reduces the opportunity for web content to open an unexpected download dialog and induce the user to save a potentially harmful file. It therefore mitigates certain automatic and deceptive download scenarios.

The setting does not inspect downloaded content and is not a substitute for SmartScreen, antimalware protection, or Internet security-zone controls. A download that the user intentionally starts is not blocked solely by this policy.

Possible side effects

Websites and legacy applications that use Internet Explorer or its components to present a download without an immediate user action can no longer offer the file through that workflow. The expected download might consequently fail to appear even though other application features remain available.

Notes

This policy is not represented by one process-independent registry value. The inetres.admx administrative template manages several values beneath the specified key for the intended process scope. The HKLM and HKCU locations represent the device and user forms of the same policy.

Microsoft lists the setting under Windows Components > Internet Explorer > Security Features > Restrict File Download. The current Policy CSP reference documents its MDM mapping for device and user scope beginning with Windows 10, version 1709. The underlying Internet Explorer security feature was introduced with Internet Explorer 6 on Windows XP Service Pack 2.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictFileDownloadInternetExplorerProcesses

Microsoft Learn: INTERNETFEATURELIST enumeration

See also