Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Java permissions

The `1C00` `REG_DWORD` value defines the permission level for Java applets in the Local Machine security zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1C00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1C00

The 1C00 REG_DWORD value defines the permission level for Java applets in the Local Machine security zone. The Zones\0 key applies only to content that Windows maps to the Local Machine zone; it does not apply to the Local Intranet, Trusted Sites, Internet, or Restricted Sites zones.

The following value data is defined:

  • 0x00000000 (0): Java applets cannot run.
  • 0x00010000 (65536): High safety. Applets run within their sandbox.
  • 0x00020000 (131072): Medium safety. In addition to the sandbox, applets receive limited capabilities such as scratch space and user-controlled file I/O.
  • 0x00030000 (196608): Low safety. Applets may perform high-capability operations.
  • 0x00800000 (8388608): Custom permissions. The individual permissions are represented by the {7839DA25-F5FE-11D0-883B-0080C726DCBB} binary value in the same key; 1C00 alone does not define the effective permissions in this mode.

The HKLM entry belongs to the device policy scope, while the HKCU entry belongs to the user policy scope.

Notes

Security

The security impact depends directly on the selected permission level. High safety confines applets to the Java sandbox. Medium safety grants additional limited capabilities, including scratch space and user-controlled file I/O. Low safety permits high-capability operations and therefore increases the potential impact of untrusted or compromised applet code.

A value of 0 prevents Java applets from running in this zone. It does not disable an installed Java runtime system-wide or affect applications that use Java outside the applicable browser and security-zone context.

Possible side effects

Disabling Java or selecting a more restrictive permission level can prevent legacy local webpages and line-of-business applications from working when they depend on Java applets or extended applet capabilities such as file I/O.

Notes

1C00 controls an applet's permissions. Separate security-zone settings determine whether Java may run (1605) and whether scripts may interact with Java applets (1402). A permissive 1C00 value does not automatically override restrictions imposed by those settings.

The policy has an effect only when a compatible Java component and an Internet Explorer-based execution environment are available. Microsoft Edge supports Java-based ActiveX controls and applicable Internet Explorer security-zone policies in IE mode, not during normal Chromium-based rendering.

Zones\0 must not be confused with Lockdown_Zones\0, which contains the separate settings for the Locked-Down Local Machine Zone.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP — LocalMachineZoneJavaPermissions

Microsoft Learn: Internet Explorer security zones registry entries for advanced users

Microsoft Learn: What is Internet Explorer mode?

See also