Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Download unsigned ActiveX controls

The `1004` `REG_DWORD` value controls the downloading of unsigned ActiveX controls for websites in the Restricted Sites zone (`Zones\4`).

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1004

The 1004 REG_DWORD value controls the downloading of unsigned ActiveX controls for websites in the Restricted Sites zone (Zones\4). It represents the URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URL action.

The value data determines the behavior:

  • 0 (URLPOLICY_ALLOW): The unsigned ActiveX control may be downloaded without prompting the user.
  • 1 (URLPOLICY_QUERY): The user is prompted to decide whether the download should be allowed.
  • 3 (URLPOLICY_DISALLOW): The download is blocked.

The policy is available in both computer and user scope. The HKLM entry represents computer policy, while the HKCU entry represents user policy.

Notes

Security

An unsigned ActiveX control provides no digital signature with which to verify its publisher or detect modification of the signed code. Allowing such downloads therefore increases the risk of transferring untrusted or altered code to the system, particularly from a site assigned to the Restricted Sites zone.

Value 0 permits the download without a security prompt. Value 1 delegates the decision to the user, but the prompt does not constitute a technical validation of the control. Value 3 prevents the download through this URL action.

Allowing the download does not by itself grant the ActiveX control unrestricted privileges. Whether the control can be installed, loaded, executed, or scripted also depends on other ActiveX policies, the user's permissions, and additional security mechanisms.

Possible side effects

Blocking unsigned ActiveX controls can prevent legacy web applications from working when they need to download such a control. With value 1, the required user prompt can interrupt automated or unattended workflows.

Notes

This setting controls only the download of unsigned ActiveX controls. It does not independently determine whether an existing control may run; separate URL actions such as URLACTION_ACTIVEX_RUN govern that behavior.

ActiveX is not supported in the normal Chromium mode of Microsoft Edge. The setting can nevertheless remain relevant to legacy Internet Explorer components and to sites opened in Microsoft Edge IE mode. IE mode supports ActiveX controls and Internet Explorer policies affecting security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneDownloadUnsignedActiveXControls

Microsoft Learn: What is Internet Explorer mode?

Microsoft Learn: URL Policy Flags

See also