Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` `REG_DWORD` value determines the permission level for Java applets in the Locked-Down Trusted Sites Zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1C00

The 1C00 REG_DWORD value determines the permission level for Java applets in the Locked-Down Trusted Sites Zone. It represents the URLACTION_JAVA_PERMISSIONS URL action.

The defined values have the following effects:

  • 0 (0x00000000): Prevents Java applets from running.
  • 65536 (0x00010000): High Safety; applets run inside a sandbox.
  • 131072 (0x00020000): Medium Safety; applets run in a sandbox but receive additional capabilities such as limited scratch space and user-controlled file I/O.
  • 196608 (0x00030000): Low Safety; applets may perform higher-capability operations such as file I/O.

The administrative template also presents a Custom option. However, Microsoft’s URL policy flag reference describes the corresponding value, 0x00800000, as not currently implemented.

Notes

Security

Lower safety levels expose more functionality to Java code beyond the stricter sandbox restrictions. In particular, Low Safety can permit operations such as file I/O. Vulnerable or malicious applets can therefore have a greater effect on data and system resources when the installed Java runtime supports those operations.

High Safety confines applets to their sandbox. A value of 0 prevents applets from running and consequently removes the Java-applet execution path covered by this policy.

This setting does not grant general administrative privileges or provide unrestricted access to files and other system resources independently of the Java runtime.

Possible side effects

Disabling Java or selecting a more restrictive safety level can prevent legacy web applications from working when they depend on Java applets or capabilities unavailable within the selected sandbox. Medium and Low Safety can improve compatibility with such applications but expose additional functionality to their applets.

Notes

Lockdown_Zones\2 represents the locked-down counterpart of the Trusted Sites Zone. It is distinct from the normal Trusted Sites Zone stored under Zones\2. The Local Machine Zone Lockdown and Network Protocol Lockdown security features compare the active URL zone’s settings with those of its locked-down equivalent.

The policy exists in both computer and user scopes. The registry hive identifies whether the value is stored as a device-wide or per-user policy.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – Locked-Down Trusted Sites Zone Java permissions

Microsoft Learn: URL Policy Flags

See also