Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Don't run antimalware programs against ActiveX controls

The `270C` value determines whether Internet Explorer consults an integrated antimalware program before creating an instance of an ActiveX control for a page in the Restricted Sites zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\270C
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\270C

The 270C value determines whether Internet Explorer consults an integrated antimalware program before creating an instance of an ActiveX control for a page in the Restricted Sites zone.

The value uses the REG_DWORD type. Its data has the following meanings:

  • 0: Internet Explorer submits ActiveX controls to the antimalware program for checking.
  • 3: Internet Explorer skips this check.

The policy name is expressed negatively: 3 turns off the antimalware check, whereas 0 enforces it. When the policy is not configured, Microsoft specifies that Internet Explorer checks ActiveX controls in the Restricted Sites zone by default; users can change the behavior through Internet Explorer security settings unless a policy controls it.

The HKLM entry represents the computer scope, while the HKCU entry represents the user scope. This setting applies only to security zone 4.

Notes

Security

A value of 3 removes an additional security check before an ActiveX control is instantiated. A malicious or compromised control can consequently be loaded without assessment by the integrated antimalware program if its execution is permitted by the other applicable security settings.

This value does not, by itself, authorize ActiveX controls to be downloaded, installed, initialized, or run. Separate security-zone settings govern those operations. Likewise, a value of 0 does not guarantee that an allowed control is harmless; it only requests evaluation by the available antimalware program.

Notes

This setting originates from the administrative templates for Internet Explorer 11. Native Microsoft Edge does not support ActiveX controls. The setting can remain relevant to sites opened in Microsoft Edge's Internet Explorer mode because IE mode uses the IE11 Trident/MSHTML engine and supports Internet Explorer policies that affect security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls

Microsoft Learn: What is Internet Explorer mode?

See also