Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` `REG_DWORD` value determines the permissions granted to Java applets in the Locked-Down Restricted Sites Zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1C00

The 1C00 REG_DWORD value determines the permissions granted to Java applets in the Locked-Down Restricted Sites Zone. Its data corresponds to the Java URL policy values:

  • 0x00000000: Prevents Java applets from running.
  • 0x00010000: High safety; applets run in a sandbox.
  • 0x00020000: Medium safety; applets run in a sandbox with additional capabilities such as scratch space and user-controlled file I/O.
  • 0x00030000: Low safety; applets may perform high-capability operations, including file I/O.
  • 0x00800000: Custom Java permissions.

Microsoft documents that disabling or not configuring the associated policy prevents Java applets from running in this locked-down zone.

Notes

Security

Low safety removes important Java sandbox restrictions and permits applets to perform high-capability operations. Untrusted Java code may consequently access files where allowed by the executing user’s security context and other system controls.

Medium safety retains the sandbox but adds capabilities that include user-controlled file I/O. High safety confines applets to the sandbox. Preventing Java applets from running provides the strongest restriction within this policy’s scope.

This setting does not grant administrative privileges to an applet or override independent Windows access controls.

Possible side effects

Preventing Java execution or selecting a more restrictive safety level can stop legacy web applications from working when they depend on Java applets or particular extended applet permissions.

Notes

The values under Lockdown_Zones\4 apply to the Locked-Down Restricted Sites Zone. They are distinct from the similarly named settings for the regular Restricted Sites Zone under Zones\4.

The HKLM value represents the device policy scope, while the HKCU value represents the user policy scope. This setting belongs to the legacy Internet Explorer security-zone infrastructure and has no independent effect in browsers that use neither Java applets nor that infrastructure.

Microsoft’s URL policy flag reference marks 0x00800000 (URLPOLICY_JAVA_CUSTOM) as not currently implemented, although the policy description presents Custom as an option for controlling permissions individually. Its effective behavior is therefore not documented consistently.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – LockedDownRestrictedSitesZoneJavaPermissions

Microsoft Learn: URL Policy Flags

See also