Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` registry value selects the permission level for Java applets in the Local Intranet zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1C00

The 1C00 registry value selects the permission level for Java applets in the Local Intranet zone. It represents the URLACTION_JAVA_PERMISSIONS URL action and applies only to content classified by Windows as belonging to that zone (Zones\1).

The value is stored as REG_DWORD. Its defined data values are:

  • 0 (0x00000000): Disable Java; Java applets cannot run.
  • 65536 (0x00010000): High Safety; applets run within their sandbox.
  • 131072 (0x00020000): Medium Safety; applets run in the sandbox with limited additional capabilities such as scratch space and user-controlled file I/O.
  • 196608 (0x00030000): Low Safety; applets may perform high-capability operations, including file I/O.
  • 8388608 (0x00800000): Custom permissions. Microsoft identifies the corresponding URL policy value as not implemented, so it must not be assumed to provide an effective custom permission set.

When the Local Intranet policy is not configured, Microsoft documents Medium Safety as the default permission level.

Notes

Security

The selected level directly determines the restrictions placed on Java applets. High Safety confines applets to their sandbox. Medium Safety grants limited capabilities beyond the basic sandbox, including user-controlled file I/O. Low Safety permits substantially broader operations and can allow untrusted intranet content to interact with local resources within the limits of the Java runtime and the signed-in user’s access rights.

A value of 0 prevents Java applets from running and removes the applet execution surface from the Local Intranet zone. This setting does not grant general administrative privileges or independently alter Windows file permissions.

Possible side effects

Disabling Java or selecting a more restrictive permission level can prevent legacy intranet applications from working when they depend on Java applets or operations outside the sandbox. The setting does not install a Java runtime and does not govern standalone Java applications.

Notes

The HKCU path supplies the setting for an individual user, while the HKLM path supplies its computer-scoped counterpart. If the separate “Security Zones: Use only machine settings” policy is enabled, Windows uses only computer settings for security zones.

The value has an effect only in applications or browser components that consume Windows security-zone policies and support Java applets. It does not add Java-applet support to modern browsers that lack it.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – IntranetZoneJavaPermissions

Microsoft Learn: URL Policy Flags

See also