Internet Explorer Processes

Purpose

Show registry keys (6)

• HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\\Reserved
• HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\explorer.exe
• HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\iexplore.exe
• HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\\Reserved
• HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\explorer.exe
• HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\iexplore.exe

This ADMX-backed policy controls protection from zone elevation for Internet Explorer components running in explorer.exe and iexplore.exe. Internet Explorer assigns content to security zones such as the Internet, Local intranet, and Local Machine zones. Each zone imposes a different set of security restrictions.

When the protection is active, FEATURE_ZONE_ELEVATION prevents content from initiating navigation from its current zone into the more privileged security context of another zone without a user action. Content in a more restricted zone therefore cannot obtain the lower restrictions of a more trusted zone merely by causing a cross-zone navigation.

When the policy is enabled or not configured, Internet Explorer can protect zones from this form of elevation. Disabling the policy removes that protection from the affected Internet Explorer processes.

Notes

Additional effects

Zone-elevation protection also blocks JavaScript navigation when no security context is available. The policy does not change site-to-zone assignments or the security options defined for individual zones.

Security

The Local Machine zone traditionally imposes fewer restrictions than the Internet and Restricted Sites zones. Without zone-elevation protection, malicious web content could attempt to reach a less restricted zone or security context through navigation that the user did not initiate.

Disabling the policy removes this protection layer from explorer.exe and iexplore.exe. It does not directly grant administrative privileges to either process or to web content, nor does it override Windows file permissions. The resulting risk depends on which additional capabilities the destination zone permits compared with the content's original zone.

Possible side effects

Legacy websites and local HTML applications may be affected if they depend on automatic navigation across security-zone boundaries or on JavaScript navigation without an established security context. Such navigation can be blocked or fail to complete as the application expects.

Notes

The policy is available in both Computer and User Configuration. Entries below HKLM represent the device-wide scope, while entries below HKCU represent the per-user scope.

This setting is not a general zone-elevation control for every application. Other processes are covered by separate policies for all processes or for an explicitly defined process list.

Microsoft lists Windows 10, version 1709 and later for the current Policy CSP mapping. The underlying Internet Explorer security feature predates that CSP exposure and was documented for earlier Windows and Internet Explorer releases.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – ProtectionFromZoneElevationInternetExplorerProcesses

Microsoft Learn: INTERNETFEATURELIST enumeration – FEATURE_ZONE_ELEVATION

See also

• Entry in the reference