Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

This policy setting controls the permission level for Java applets in the **Trusted Sites Zone**.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1C00

This policy setting controls the permission level for Java applets in the Trusted Sites Zone. Zone number 2 identifies that zone, and the 1C00 DWORD value represents the URLACTION_JAVA_PERMISSIONS URL action.

The defined value data is:

  • 0 (0x00000000): Disable Java; Java applets cannot run.
  • 65536 (0x00010000): High Safety; applets are restricted to the Java sandbox.
  • 131072 (0x00020000): Medium Safety; applets run in the sandbox but receive additional capabilities such as scratch space and user-controlled file I/O.
  • 196608 (0x00030000): Low Safety; applets may perform high-capability operations, including file I/O.
  • 8388608 (0x00800000): Custom permissions. Microsoft's technical reference identifies the underlying URLPOLICY_JAVA_CUSTOM value as not currently implemented.

The HKLM entry represents the computer-scoped policy, while the HKCU entry represents the user-scoped policy. The setting applies only to content classified in the Trusted Sites Zone by components that use the Internet Explorer security-zone architecture.

Notes

Security

Lower safety levels give Java applets broader ways to interact with local resources. In particular, Low Safety permits high-capability operations such as file I/O within the Java permission model. A malicious or compromised applet could therefore have a greater impact on data accessible to the signed-in user.

This setting does not grant administrative privileges or unrestricted system access. Operating-system permissions, the rights of the executing user account, and other security controls continue to apply.

The risk also depends on which sites are assigned to the Trusted Sites Zone. This setting does not assign sites to the zone and does not install or enable a Java runtime.

Possible side effects

The 0 and 65536 values can prevent legacy web applications from working when they depend on Java applets or operations outside the sandbox. Medium or Low Safety may restore additional application functionality but also expands the operations available to those applets.

Notes

When this policy is not configured for the Trusted Sites Zone, Microsoft documents Low Safety as the default permission level. The value has an effect only when the browser or hosting environment supports Java applets and evaluates Internet Explorer security zones. It does not control standalone Java applications.

Although the Microsoft policy description offers a Custom permissions option, the technical URL Policy Flags reference marks its corresponding URLPOLICY_JAVA_CUSTOM value as not currently implemented.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP — TrustedSitesZoneJavaPermissions

Microsoft Learn: URL Policy Flags

See also