Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Download signed ActiveX controls

This policy controls the downloading of signed ActiveX controls from webpages assigned to the Internet zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001

This policy controls the downloading of signed ActiveX controls from webpages assigned to the Internet zone. Registry value 1001 is the URLACTION_DOWNLOAD_SIGNED_ACTIVEX URL action and uses the REG_DWORD data type.

The supported value data has the following effects:

  • 0: Signed ActiveX controls may be downloaded without user intervention.
  • 1: The user is prompted for controls signed by an untrusted publisher. Code signed by a trusted publisher is downloaded without a prompt.
  • 3: Signed ActiveX controls cannot be downloaded.

When the policy is not configured, users are prompted for controls signed by untrusted publishers, while code signed by trusted publishers is downloaded without a prompt.

Notes

Security

A digital signature identifies the publisher and provides a way to verify that signed code has not been altered since it was signed. It does not establish that an ActiveX control is free from vulnerabilities or malicious behavior.

Value 0 permits signed controls from the Internet zone to be downloaded without a user decision. This can allow signed but malicious or vulnerable code to reach the system. Value 1 retains a user prompt for untrusted publishers, while value 3 blocks this download path.

This setting does not permit unsigned ActiveX controls and does not, by itself, authorize a downloaded control to run. Installation, loading, initialization, scripting, and execution remain subject to other ActiveX, add-on, and security policies.

Possible side effects

Value 3 can prevent legacy websites or line-of-business applications from obtaining or updating a required signed ActiveX control. Value 1 can introduce security prompts. This download policy does not inherently disable controls that are already present; their execution is governed by separate settings.

Notes

The HKLM path represents the computer policy scope, while the HKCU path represents the user policy scope. Both paths implement the same Internet-zone setting rather than separate ActiveX capabilities.

Although the Internet Explorer desktop application has been retired on certain Windows versions, this setting can remain relevant to sites opened in Microsoft Edge Internet Explorer mode. IE mode supports ActiveX controls and Internet Explorer policies that affect security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP — InternetZoneDownloadSignedActiveXControls

Microsoft Learn: URL Policy Flags

Microsoft Learn: What is Internet Explorer mode?

See also