Don't run antimalware programs against ActiveX controls
This registry value determines whether Internet Explorer consults an antimalware program before creating an instance of an ActiveX control for content in the Local Machine zone.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\270CHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\270C
This registry value determines whether Internet Explorer consults an antimalware program before creating an instance of an ActiveX control for content in the Local Machine zone.
The value uses the REG_DWORD data type. Its supported data values have the following meanings:
0: Internet Explorer checks the ActiveX control with the available antimalware program.3: Internet Explorer skips the antimalware check.
The setting controls only this antimalware inspection step. It does not independently allow or block ActiveX controls; other ActiveX and zone security settings continue to determine whether a control may be loaded or executed.
Notes
Security
A value of 3 removes a security check from ActiveX instantiation in the Local Machine zone. If the remaining security settings permit a control to run, Internet Explorer can instantiate it without first consulting the antimalware program. This increases the risk that a malicious or compromised control will execute.
A value of 0 requires the check, but it does not grant additional capabilities to the antimalware product or replace other security controls. An effective check also depends on Internet Explorer being able to consult a suitable antimalware program.
Notes
Zones\0 represents the Local Machine zone. The setting therefore does not automatically affect ActiveX controls in the Internet, Local Intranet, Trusted Sites, or Restricted Sites zones.
The HKLM and HKCU locations represent the device and user scopes of the policy, respectively. Microsoft lists the setting as available in both scopes.
When this policy is not configured for the Local Machine zone, Microsoft states that Internet Explorer does not perform this antimalware check by default and that users can change the behavior through Internet Explorer security settings. An absent policy value is therefore not equivalent to a value of 0.
Microsoft documents this ADMX-backed policy for Internet Explorer on Windows 10, version 1709 and later. It has an effect only in contexts where Internet Explorer technology and ActiveX controls are still used.