Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow active scripting

This policy setting determines whether script code may run on pages assigned to the Internet Explorer **Restricted Sites** security zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400

This policy setting determines whether script code may run on pages assigned to the Internet Explorer Restricted Sites security zone. The 1400 value represents the URLACTION_SCRIPT_RUN URL action.

The value is stored as REG_DWORD. The defined value data is:

  • 0: Allow script code to run without prompting.
  • 1: Prompt the user before allowing script code to run.
  • 3: Prevent script code from running.

The policy can apply in either the computer or user context. A value under HKLM applies to the computer, while a value under HKCU applies to the individual user. If both policy values are present, the computer policy under HKLM takes precedence.

Notes

Security

Allowing active scripting removes an important active-content restriction from the Restricted Sites zone. Script supplied by a page assigned to this zone can then execute within the browser's security context, increasing the attack surface exposed to malicious or compromised web content.

This setting does not automatically disable other security boundaries. It does not grant scripts general operating-system privileges or independently bypass other zone policies, browser protections, or access controls. The actions available to a script continue to depend on those additional controls.

Value 1 transfers the decision to the user rather than consistently blocking scripts. Script execution therefore remains possible when the user approves the prompt.

Possible side effects

With value 3, pages that depend on scripts for navigation, forms, dynamic content, or other features might be incomplete or fail to operate correctly. Value 1 can produce recurring security prompts and inconsistent behavior based on each user's response.

Notes

This setting applies only to the Restricted Sites security zone, identified by zone number 4. It is not a general switch for disabling JavaScript or other scripting languages across all browsers.

An absent policy value is not necessarily equivalent to explicitly setting the value to 3: the effective behavior can then come from another permitted configuration source or from the security zone defaults. Microsoft documents the unconfigured policy behavior for this zone as preventing script code from running.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneAllowActiveScripting

Microsoft Learn: URL Policy Flags

See also