Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Logon options

The `1A00` value represents the `URLACTION_CREDENTIALS_USE` security setting for the Internet Zone, which has zone identifier `3`.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1A00

The 1A00 value represents the URLACTION_CREDENTIALS_USE security setting for the Internet Zone, which has zone identifier 3. It is a REG_DWORD value that determines how Windows components use credentials for resources assigned to that zone.

The defined value data is:

  • 0x00000000 (0): Automatic logon with the current user name and password. If the server supports Windows Integrated Authentication, authentication is attempted with the current Windows credentials. Otherwise, the user may be prompted.
  • 0x00010000 (65536): Prompt for a user name and password. After the user responds, the supplied credentials may be reused silently for the remainder of the session.
  • 0x00020000 (131072): Automatic logon only in the Intranet Zone. A resource in the Internet Zone covered by this value therefore causes an authentication prompt.
  • 0x00030000 (196608): Anonymous logon only. HTTP authentication with user credentials is disabled; only the guest account is used for the CIFS protocol.

When the associated policy is disabled or not configured, the effective option is “Automatic logon only in Intranet zone.” Credentials are therefore not used automatically for Internet Zone websites.

Notes

Additional effects

By default, Microsoft Edge evaluates URLACTION_CREDENTIALS_USE when deciding whether to perform Windows Integrated Authentication with Kerberos or NTLM automatically or display a manual authentication prompt. Edge does not consult the zone policy for this decision when the AuthServerAllowlist policy governs the relevant servers.

Internet Explorer mode also uses Windows Security Zones and observes their settings.

Security

0x00000000 permits the current Windows credentials to be used automatically with servers in the Internet Zone. This substantially expands the set of websites to which Windows authentication information may be offered without first prompting the user. An untrusted server may learn the user's Windows identity, and NTLM exchanges can increase the risk of captured authentication data being misused.

0x00010000 and 0x00020000 prevent automatic credential release for Internet Zone resources, but still permit authentication after prompting the user. Credentials supplied in response to a prompt may then be reused silently for the remainder of the session.

0x00030000 prevents personal credentials from being used for the affected HTTP authentication and provides the strongest protection against unintended credential release through this setting.

Possible side effects

Options that require prompting can produce additional authentication dialogs and interrupt unattended access by applications or embedded browser components. Anonymous-only logon can prevent access to websites and services that require authenticated connections.

Notes

The HKLM location represents the computer-scoped policy value, while the HKCU location applies to the individual user. Both values have the same functional meaning.

The setting affects only resources that Windows assigns to the Internet Zone. It does not grant general access rights or transmit passwords independently of the authentication protocol and capabilities supported by the destination server.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneLogonOptions

Microsoft Learn: Per-site configuration by policy

Microsoft Learn: URL Policy Flags

See also