Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Show security warning for potentially unsafe files

The `1806` DWORD value governs the `URLACTION_SHELL_EXECUTE_HIGHRISK` URL security action for the Restricted Sites zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1806
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1806

The 1806 DWORD value governs the URLACTION_SHELL_EXECUTE_HIGHRISK URL security action for the Restricted Sites zone. It determines whether Windows may open executable files and other files classified as potentially unsafe without interruption, must display the “Open File – Security Warning” prompt first, or must block the operation.

The supported value data has the following meaning:

  • 0 (URLPOLICY_ALLOW): The file may open without a security warning.
  • 1 (URLPOLICY_QUERY): Windows displays a security warning and lets the user allow or cancel the operation.
  • 3 (URLPOLICY_DISALLOW): Windows prevents the file from opening.

The setting applies only when the file's source is evaluated as security zone 4, the Restricted Sites zone.

Notes

Security

A value of 0 removes the warning that would otherwise stand between the user and a potentially dangerous file from this zone. This can make malicious executable content easier to launch. It does not grant administrative privileges, override file permissions, or disable Microsoft Defender Antivirus or other security controls.

A value of 1 preserves an explicit user decision before the file opens. A value of 3 provides the strongest protection offered by this URL action because affected files cannot be opened.

This setting is not a general application-control policy. In particular, it does not determine whether files can be downloaded and is not a substitute for controls such as Windows Defender Application Control or AppLocker.

Possible side effects

With a value of 3, Windows can also block legitimate applications or documents when their source is assigned to the Restricted Sites zone. A value of 1 adds a confirmation prompt when an affected file is opened.

Notes

The two policy paths represent the computer and user variants of the same ADMX-backed setting. When the policy is not configured, the user can generally choose the behavior through Internet Options. Microsoft documents blocking as the default behavior for potentially unsafe files in the Restricted Sites zone.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles

Microsoft Learn: URL Policy Flags

See also