Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

This ADMX-backed Internet Explorer policy sets the permission level for Java applets in the **Restricted Sites** zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1C00

This ADMX-backed Internet Explorer policy sets the permission level for Java applets in the Restricted Sites zone. The 1C00 DWORD value represents the URLACTION_JAVA_PERMISSIONS URL action.

The supported value data has the following meanings:

  • 0 (0x00000000): Disable Java; applets cannot run.
  • 65536 (0x00010000): High Safety; applets run in their sandbox.
  • 131072 (0x00020000): Medium Safety; applets run in their sandbox with additional capabilities such as scratch space and user-controlled file I/O.
  • 196608 (0x00030000): Low Safety; applets may perform higher-capability operations.
  • 8388608 (0x00800000): Custom permissions. The policy description presents this as a way to control permissions individually, although Microsoft's URL policy flag reference marks the corresponding constant as not currently implemented.

The HKLM path represents the device policy scope, while the HKCU path represents the user policy scope.

Notes

Security

High Safety confines Java applets to the Java sandbox. Medium Safety adds capabilities including scratch space and user-controlled file I/O. Low Safety grants substantially broader capabilities and therefore increases the potential impact of a malicious or compromised applet.

These permission levels do not automatically give an applet administrative privileges or unrestricted access to files and other system resources. Effective access remains subject to the Java implementation, the security context of the hosting process, the signed-in user's permissions, and other operating-system restrictions.

Possible side effects

Disabling Java or selecting a more restrictive safety level can prevent legacy web applications that depend on Java applets from working correctly. Applications that require scratch space or user-controlled file I/O may fail under High Safety.

Notes

This setting applies only to content assigned to the Restricted Sites zone, which has zone number 4. It does not assign websites to that zone.

It controls Java applets, not JavaScript. Scripting of Java applets is also governed by a separate policy and URL action.

The setting has a practical effect only in a compatible host that supports Java applets and the Internet Explorer security-zone model. It does not enable Java execution when no suitable Java runtime or applet host is available.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – Restricted Sites Zone Java permissions

Microsoft Learn: URL Policy Flags

See also