Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Download signed ActiveX controls

The `1001` `REG_DWORD` value controls whether a signed ActiveX control may be downloaded from a page assigned to the **Restricted Sites Zone**.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1001

The 1001 REG_DWORD value controls whether a signed ActiveX control may be downloaded from a page assigned to the Restricted Sites Zone. Windows evaluates the zone of the HTML page containing the control, rather than assigning the decision solely from the control’s download location.

The recognized URL-policy values have these effects:

  • 0 allows the download. Controls signed by trusted publishers are downloaded silently.
  • 1 prompts the user before downloading a control signed by a publisher that is not trusted. Code signed by a trusted publisher is still downloaded silently.
  • 3 blocks the download.

When this Restricted Sites Zone policy is not configured, signed ActiveX controls cannot be downloaded by default.

Notes

Security

A value of 0 weakens the protection normally associated with the Restricted Sites Zone because signed controls may be downloaded without user interaction. A valid signature establishes information about the publisher and helps detect modification after signing; it does not establish that the control is secure or free from exploitable defects.

Value 1 retains a consent boundary for publishers that Windows does not trust, while trusted-publisher downloads remain silent. Value 3 provides the most restrictive behavior for this specific download action.

Possible side effects

Value 3 can prevent legacy web applications from working when they depend on downloading a signed ActiveX control that is not already installed. Value 1 can interrupt an otherwise automatic workflow with a security prompt and make completion dependent on the user’s decision.

Notes

This value governs only the download of signed ActiveX controls. It does not by itself authorize a downloaded control to run, initialize, or interact with scripts. Those operations remain subject to separate ActiveX and security-zone policies, as well as applicable signature and trust checks.

The two registry locations represent the device and user scopes of the same policy. The setting matters only to applications that support ActiveX and the Internet Explorer URL-security-zone model; it does not enable ActiveX in modern browser engines.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneDownloadSignedActiveXControls

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

See also