Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` DWORD value selects the Java permission level for Java applets in the Locked-Down Intranet Zone of Internet Explorer or in compatible components that evaluate Internet Explorer security zones.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1C00

The 1C00 DWORD value selects the Java permission level for Java applets in the Locked-Down Intranet Zone of Internet Explorer or in compatible components that evaluate Internet Explorer security zones.

The defined value data has the following effects:

  • 0x00000000: Java applets are prevented from running.
  • 0x00010000: High Safety. Applets run in a sandbox.
  • 0x00020000: Medium Safety. Applets run in a sandbox but receive additional capabilities such as scratch space and user-controlled file I/O.
  • 0x00030000: Low Safety. Applets may perform higher-capability operations, including file I/O.

These levels govern permissions within the Java and browser security model. They do not automatically grant an applet Windows administrative privileges or override the effective permissions of the user account running it.

Notes

Security

Lowering the safety level expands what Java applets can do. In particular, Low Safety permits file I/O and other higher-capability operations. A malicious or compromised applet may consequently have greater opportunity to access data and resources available to the current user.

High Safety confines applets to their sandbox. Medium Safety adds selected controlled capabilities. Setting the value to 0x00000000 prevents Java applets from running and is therefore the most restrictive state provided by this setting.

Possible side effects

Disabling Java or selecting a more restrictive permission level can prevent legacy intranet applications from working when their applets require Java support or capabilities unavailable at the selected sandbox level.

Notes

The paths under Lockdown_Zones\1 apply only to the Locked-Down Intranet Zone. They are distinct from the normal Intranet Zone represented by Zones\1.

The HKLM path belongs to the device policy scope, while the HKCU path belongs to the user policy scope. The corresponding ADMX-backed policy supports both scopes.

Microsoft also defines 0x00800000 as URLPOLICY_JAVA_CUSTOM, but its URL Policy Flags reference identifies this custom Java policy as not currently implemented. No dependable additional permission behavior should therefore be inferred from that value.

This setting has an effect only where Java applets and Internet Explorer security zones are in use. Microsoft Edge in IE mode supports Internet Explorer security-zone settings and ActiveX controls such as Java; the setting does not govern modern web content rendered in the regular Microsoft Edge mode.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – LockedDownIntranetJavaPermissions

Microsoft Learn: URL Policy Flags

Microsoft Learn: What is Internet Explorer mode?

See also