Allow only approved domains to use ActiveX controls without prompt
This ADMX-backed policy controls per-domain approval for installed ActiveX controls in the Internet zone.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\120bHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\120b
This ADMX-backed policy controls per-domain approval for installed ActiveX controls in the Internet zone. It applies when a website attempts to use an ActiveX control that was installed by a different website.
When the restriction is in effect, Internet Explorer prompts the user before the control can run. The user can allow the control for the current website or for all websites. Without this restriction, the per-site ActiveX prompt is not displayed and the control can generally be used by all websites in the Internet zone.
This setting does not independently permit or block ActiveX controls. Other security-zone settings governing the execution, download, initialization, and scripting of ActiveX controls continue to apply.
Notes
Security
Per-domain prompting limits the websites that can use an installed ActiveX control without prior consent. It can therefore prevent an arbitrary Internet-zone website from immediately invoking a control installed for another site.
The prompt is not an administrator-only allowlist: the user can approve the control for the current website or for all websites. If the prompt is suppressed, every website in the Internet zone can access the control when its execution is otherwise permitted by the applicable zone settings. This increases the attack surface, particularly when an installed control contains an exploitable vulnerability or exposes powerful functionality. The actual impact depends on the individual control and the privileges available to it.
Possible side effects
The per-domain restriction can introduce additional prompts in legacy web applications when an ActiveX control was installed by a different website from the one that subsequently uses it. If the required approval is not granted, the affected website functionality may be unavailable.
Notes
The Zones\3 subkey applies specifically to the Internet zone. The HKLM and HKCU locations represent the computer-policy and user-policy variants, respectively.
The setting applies to security-zone processing performed by Internet Explorer technology. It can remain relevant to pages running in Microsoft Edge Internet Explorer mode, which supports ActiveX controls and Internet Explorer security-zone policies. It does not add ActiveX support to ordinary Microsoft Edge pages rendered by the Chromium engine.
Microsoft documentation
Microsoft Learn: What is Internet Explorer mode?