Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` registry value determines the permission level for Java applets in the Locked-Down Local Machine Zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1C00

The 1C00 registry value determines the permission level for Java applets in the Locked-Down Local Machine Zone. This zone is the restricted counterpart of the regular Local Machine Zone. Internet Explorer lockdown features compare the settings of the active security zone with those of its locked-down equivalent.

The policy provides these permission levels:

  • Low Safety: Java applets can perform all operations permitted by the Java security model.
  • Medium Safety: Applets run in their sandbox but receive additional capabilities, including protected scratch space and user-controlled file I/O.
  • High Safety: Applets run only within their sandbox.
  • Custom: Individual Java permissions are controlled separately.
  • Disable Java: Java applets cannot run.

If the policy is disabled or not configured, Java applets are disabled in this locked-down zone.

Notes

Security

Selecting a less restrictive permission level increases what a Java applet can do. In particular, Low Safety largely removes the Java restrictions imposed by the higher safety levels. A malicious or compromised applet can therefore have a greater impact within the permissions available to the Java runtime and its hosting process.

Medium Safety adds capabilities such as user-controlled file I/O to sandboxed execution. High Safety confines applets to their sandbox, while Disable Java prevents them from running.

This setting does not by itself grant Windows administrative privileges, unrestricted file access, or general control of the computer. Effective access remains subject to the Java runtime, the hosting process, and the Windows permissions of the affected user.

Possible side effects

Disabling Java or selecting a more restrictive permission level can prevent legacy local HTML applications and other older content from working when they depend on Java applets or permissions outside the sandbox. File operations and the use of scratch storage are among the functions that can be affected.

Notes

The HKLM and HKCU entries represent the device and user scopes of the same ADMX-backed policy. The value applies specifically to the Locked-Down Local Machine Zone and must not be treated as equivalent to a similarly named value in a regular Internet Explorer security zone.

This setting neither installs nor enables a Java runtime. It has an effect only in a compatible Internet Explorer or URL security-zone context that supports Java applets.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – LockedDownLocalMachineZoneJavaPermissions

Microsoft Learn: URL Action Flags – URLACTION_JAVA_PERMISSIONS

See also