Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Internet Explorer Processes

These registry entries belong to the ADMX-backed Internet Explorer Processes policy under MK Protocol Security Restriction.

since 0.9.8.11

Purpose

Show registry keys (6)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\\Reserved
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\explorer.exe
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\iexplore.exe
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\\Reserved
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\explorer.exe
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_MK_PROTOCOL\iexplore.exe

These registry entries belong to the ADMX-backed Internet Explorer Processes policy under MK Protocol Security Restriction. When the restriction is enabled, Windows prevents File Explorer and Internet Explorer from using the MK protocol. Resources addressed through that protocol consequently fail to load in those processes.

When the restriction is disabled, applications can use the MK protocol API and MK-hosted resources can operate in the File Explorer and Internet Explorer processes. According to the current Microsoft policy reference, the protocol is also prevented for these processes when the policy is not configured.

MK is a legacy protocol that can, among other uses, address content inside compiled HTML Help files through URLs beginning with mk:@MSITStore:.

Notes

Security

Preventing the protocol reduces the attack surface of File Explorer and Internet Explorer by removing MK as a path through which resources can be loaded and processed. The protocol family was historically used for compiled HTML Help content and has been subject to additional security restrictions.

The documented scope is limited to the explorer.exe and iexplore.exe processes. This setting does not constitute a system-wide prohibition of the MK protocol for every Windows process.

Possible side effects

Legacy web applications, help systems, or other content that references resources through the MK protocol may stop working correctly in File Explorer or Internet Explorer. Affected links may fail, and content stored in compiled help files may no longer be displayed.

Notes

The policy is available in both Computer Configuration and User Configuration, which accounts for the corresponding entries under HKLM and HKCU. The (Reserved), explorer.exe, and iexplore.exe value names are components of the same process-specific ADMX policy rather than three independent security features.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – MKProtocolSecurityRestrictionInternetExplorerProcesses

Microsoft Learn: About HTML Help URLs

Microsoft Learn: Microsoft Security Bulletin MS05-026

See also