Turn on Protected Mode

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500

This policy controls Protected Mode for websites in the Internet zone in Internet Explorer and for applicable content running in Microsoft Edge IE mode. Protected Mode runs web content at low integrity, limiting the file-system and registry locations to which the affected process can write.

2500 is a REG_DWORD value. A value of 0 turns Protected Mode on, while 3 turns it off. When the policy is enabled, users cannot turn Protected Mode off for the Internet zone. When the policy is disabled, users cannot turn it on. If the policy is not configured, users can generally change the setting unless another policy prevents them from doing so.

The HKLM path represents the computer-scoped policy, while the HKCU path represents the user-scoped policy.

Notes

Security

Protected Mode reduces the potential impact of vulnerabilities exploited in the Internet Explorer engine. Code running inside a protected process cannot freely write to files, registry keys, or processes at a higher integrity level. This makes it more difficult to alter user or system settings or establish persistent malicious code.

Protected Mode does not prevent exploitation and is not a complete security boundary. Turning it off removes this additional containment layer for Internet-zone content. Such content can then run at a higher integrity level and consequently has broader write access within the user's security context.

Possible side effects

Legacy web applications, add-ons, or embedded browser components that expect direct write access outside low-integrity locations might not work as intended while Protected Mode is active.

Sign-in and redirection workflows that cross security zones with different Protected Mode settings can involve processes running at different integrity levels. In some older desktop applications, this can prevent authentication data or other information from passing between the participating pages.

Notes

This setting applies only to the Internet zone, represented by zone key 3. The Local intranet, Trusted sites, Restricted sites, and Local machine zones use their own zone-specific settings.

Protected Mode is separate from Enhanced Protected Mode. Enhanced Protected Mode imposes additional restrictions, including limits on readable locations, and is controlled by different policy values.

The standalone Internet Explorer 11 desktop application has been retired or disabled on many Windows versions. Microsoft Edge IE mode nevertheless continues to support Internet Explorer policies that affect security zones and Protected Mode. If the separate “Security Zones: Use only machine settings” policy is active, only computer-level security-zone settings are used.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneEnableProtectedMode

Microsoft Learn: Internet Explorer settings – Enable Protected Mode

Microsoft Learn: What is Internet Explorer (IE) mode?

See also

• Entry in the reference