Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Download unsigned ActiveX controls

This policy controls whether a page in the Internet zone may download an unsigned ActiveX control.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004

This policy controls whether a page in the Internet zone may download an unsigned ActiveX control. Registry value 1004 represents the URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URL action, while zone number 3 identifies the Internet zone.

The value uses the REG_DWORD type and supports these policy states:

  • 0: Allow the download without prompting the user.
  • 1: Ask the user whether the control should be allowed.
  • 3: Block the download.

The policy is limited to unsigned ActiveX controls. It does not independently authorize a downloaded or previously installed control to run, initialize, or interact with scripts. Those operations remain subject to separate ActiveX and security-zone policies.

Notes

Security

A value of 0 permits Internet-zone pages to supply unsigned ActiveX code without user confirmation. Because the code has no digital signature with which to validate its publisher and integrity, this increases exposure to malicious or modified controls. It does not automatically give a control administrative privileges; subsequent activity remains constrained by the control's execution context, the user's permissions, and other applicable security settings.

A value of 1 prevents silent downloading but makes the outcome dependent on the user's decision. A deceptive page may still persuade a user to approve an unsafe control.

A value of 3 blocks this download path and reduces the attack surface associated with unsigned ActiveX code originating from the Internet zone.

Possible side effects

Blocking unsigned controls can prevent legacy web applications from acquiring an ActiveX component they require. This policy alone does not prohibit an already installed control from running; separate policies govern ActiveX execution, initialization, and scripting.

Notes

The setting applies only to content classified in the Internet zone. If a site is assigned to another zone, such as Local intranet or Trusted sites, the corresponding setting for that zone determines the result.

The HKCU path holds the user-scoped policy, whereas the HKLM path holds the device-scoped policy. If the “Security Zones: Use only machine settings” policy is in effect, Windows uses only the machine-level security-zone settings.

Microsoft Edge does not use ActiveX in its normal Chromium browsing mode. Edge IE mode does support ActiveX controls and honors Internet Explorer policies that affect security-zone settings.

This policy is distinct from settings that address invalid signatures and from the separate policies governing whether ActiveX controls may run, initialize, or be scripted.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP — InternetZoneDownloadUnsignedActiveXControls

Microsoft Learn: What is Internet Explorer mode?

See also