Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Logon options

The `1A00` DWORD value controls how credentials are handled when a website in the Restricted Sites Zone requests HTTP authentication.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A00
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1A00

The 1A00 DWORD value controls how credentials are handled when a website in the Restricted Sites Zone requests HTTP authentication. It represents the URLACTION_CREDENTIALS_USE URL action.

The following value data is defined:

  • 0x00000000 (0): Automatic logon with the current user name and password. Windows attempts to authenticate automatically with the signed-in user's credentials. If the server does not support the applicable challenge-response authentication mechanism, the user is prompted for credentials.
  • 0x00010000 (65536): The user must be prompted for a user name and password. After they are entered, the credentials may be reused silently for the remainder of the session.
  • 0x00020000 (131072): Automatic logon only in the Intranet Zone. Because this instance of the setting applies to the Restricted Sites Zone, the user is prompted for a user name and password here. The supplied credentials may subsequently be reused without another prompt for the remainder of the session.
  • 0x00030000 (196608): Anonymous logon only. Personal credentials are not used for HTTP authentication; for the CIFS protocol, only the guest account is used.

When the associated Group Policy setting is disabled, Windows uses “Automatic logon only in Intranet zone.” When it is not configured, the default for the Restricted Sites Zone is to prompt for a user name and password.

Notes

Security

Automatic logon with the current user's credentials (0x00000000) can release Windows authentication credentials to a server in a zone specifically intended for untrusted sites without first obtaining user confirmation. This removes the protection provided by an interactive authentication prompt.

Values 0x00010000 and 0x00020000 prevent an initial silent logon in this zone, but credentials entered by the user may still be reused for the remainder of the session. Anonymous logon (0x00030000) prevents personal credentials from being released, but it can make resources that require an authenticated session inaccessible.

Possible side effects

Options that require user input can produce additional authentication prompts. Anonymous logon can cause sign-in failures or access denials on websites and network resources that require authentication. Automatic logon can instead result in resources being accessed unexpectedly under the currently signed-in Windows account.

Notes

The HKLM and HKCU locations represent the computer and user variants of the same policy. Zone number 4 identifies the Restricted Sites Zone.

Microsoft Edge uses Windows Security Zones for a limited set of decisions, including the release of credentials for Windows Integrated Authentication by default. When the Edge AuthServerAllowlist policy applies, Edge does not consult this zone policy for that decision. Internet Explorer mode tabs evaluate zone settings in the same way as Internet Explorer.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneLogonOptions

Microsoft Learn: Per-site configuration by policy

Microsoft Learn: URL Policy Flags

See also