Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow scriptlets

The `1209` value controls the `URLACTION_ACTIVEX_SCRIPTLET_RUN` URL security action for the Internet zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1209
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1209

The 1209 value controls the URLACTION_ACTIVEX_SCRIPTLET_RUN URL security action for the Internet zone. It determines whether Internet Explorer may run DHTML scriptlets. Scriptlets are a legacy, Internet Explorer-specific component technology for reusable scripted content; this setting does not control JavaScript or VBScript execution in general.

The value uses the REG_DWORD data type. The standard URL policy data values have the following meanings:

  • 0 (URLPOLICY_ALLOW): Allow scriptlets to run without prompting.
  • 1 (URLPOLICY_QUERY): Ask the user whether execution should be allowed.
  • 3 (URLPOLICY_DISALLOW): Prevent scriptlets from running.

The HKLM path supplies the computer-scoped policy, while the HKCU path supplies the user-scoped policy. When the policy is not defined, the corresponding zone setting remains under user control.

Notes

Security

A value of 0 permits sites in the Internet zone to use this legacy active-content mechanism. This gives untrusted web content an additional way to execute script code. The code remains subject to the other security restrictions imposed by the zone and the hosting process.

This setting does not grant administrative privileges or generally enable all ActiveX controls. Microsoft specifically documents that the scriptlet action has no effect when the execution of ActiveX controls and plug-ins, controlled by value 1200, is disabled.

A value of 3 blocks scriptlet execution in the Internet zone. With a value of 1, execution depends on the user's response to the security prompt.

Possible side effects

Blocking scriptlets can affect legacy websites or browser-based business applications that depend on DHTML scriptlets for user-interface elements, event handling, or reusable scripted components. Other scripting technologies are not directly disabled by value 1209.

Notes

Zone number 3 represents the Internet zone only. Other security zones and locked-down zones use separate registry paths.

The URL security action for scriptlets was introduced with Internet Explorer 7. Microsoft lists the corresponding ADMX-backed CSP policy for both device and user scope beginning with Windows 10, version 1703.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneAllowScriptlets

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

See also