Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Process List

This Group Policy setting determines, for individual executable files, whether the Internet Explorer Protection From Zone Elevation feature applies.

since 0.9.8.11

Purpose

Show registry keys (4)
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\ListBox_Support_FEATURE_ZONE_ELEVATION
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\ListBox_Support_FEATURE_ZONE_ELEVATION
  • HKLM\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION
  • HKCU\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION

per-process value names

This Group Policy setting determines, for individual executable files, whether the Internet Explorer Protection From Zone Elevation feature applies. The feature prevents navigation that was not initiated by the user from a page in one security zone to a more privileged, less restricted zone.

The process-specific mappings reside under FEATURE_ZONE_ELEVATION. Each value name is the executable file name, and its data is a REG_DWORD:

  • 1 enables protection for the specified process and can prevent zone elevation.
  • 0 permits zone elevation for the specified process.

An empty value name or data other than 0 or 1 is ignored. ListBox_Support_FEATURE_ZONE_ELEVATION represents the state of the list-based policy; the values below FEATURE_ZONE_ELEVATION define the individual process decisions.

Notes

Additional effects

Protection From Zone Elevation also disables JavaScript navigation when no security context is available.

If the related All Processes policy is enabled, entries explicitly defined in this process list take precedence. Internet Explorer processes have a separate policy and are not intended to be represented by entries in this list.

Security

A value of 1 makes it harder for content in a more restricted zone to navigate, without user action, into a context governed by fewer security restrictions. This reduces opportunities for less-trusted content to exploit a security-zone boundary.

A value of 0 removes this protection for the named process. This is security-sensitive when that process handles untrusted content through the Internet Explorer or MSHTML engine. It does not grant Windows user rights, administrative privileges, or general access to files.

Possible side effects

A value of 1 can block legitimate automatic navigation between security zones in legacy web applications or applications that host the Internet Explorer WebBrowser control. Redirects and similar script-driven workflows may consequently fail.

Notes

This setting is a per-process Internet Explorer feature control, not a general security-zone policy for every browser. The feature was introduced with Internet Explorer 6 on Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1.

The Internet Explorer 11 desktop application is no longer supported on certain Windows versions. This setting is primarily relevant to legacy applications based on Internet Explorer or MSHTML; it does not control the Chromium engine in Microsoft Edge.

HKLM supplies the computer-wide policy scope, while HKCU contains the user-scoped form of the same policy.

Microsoft documentation

Microsoft Learn: INTERNETFEATURELIST enumeration — FEATURE_ZONE_ELEVATION

Microsoft Learn: Internet Explorer 11 desktop application ended support for certain operating systems

See also