Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Allow VBScript to run in Internet Explorer

The `140C` value controls whether Internet Explorer may run VBScript on pages in the **Restricted Sites Zone**.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\140C
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\140C

The 140C value controls whether Internet Explorer may run VBScript on pages in the Restricted Sites Zone. The value under HKLM represents the device policy, while the value under HKCU represents the user policy.

The policy supports three behaviors:

  • 0 (REG_DWORD): VBScript may run without user interaction.
  • 1 (REG_DWORD): The user is prompted before VBScript is allowed to run.
  • 3 (REG_DWORD): VBScript execution is blocked.

According to the current Microsoft policy reference, VBScript is also blocked when this policy is disabled or not configured. Other zone policies, particularly Allow active scripting, can impose additional restrictions on script execution.

Notes

Security

Allowing VBScript increases the attack surface presented by pages deliberately assigned to the Restricted Sites Zone. Such pages can execute VBScript within the security context of the Internet Explorer engine and use capabilities that remain available under the other zone and browser security settings.

This setting does not override other security controls automatically. By itself, it does not permit ActiveX controls to run, grant unrestricted access to local files, or bypass other zone policies. With the prompt option, execution depends on the user's response.

Possible side effects

Blocking VBScript can cause legacy websites and line-of-business applications that depend on client-side VBScript to lose functionality or fail to operate. The prompt option can interrupt page workflows with recurring security decisions.

Notes

Microsoft lists this device- and user-scoped policy as applicable starting with Windows 10, version 1803. Although the standalone Internet Explorer 11 desktop application is retired or disabled on many Windows versions, Internet Explorer security-zone policies can remain relevant to pages loaded through the MSHTML engine in Microsoft Edge IE mode.

This setting applies only to VBScript in the Restricted Sites Zone. It is not a general script-blocking control and does not govern JavaScript in regular Microsoft Edge tabs.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer

Microsoft Learn: What is Internet Explorer mode?

See also