Allow only approved domains to use ActiveX controls without prompt
The `120b` registry value controls the per-domain ActiveX prompt for the **Restricted Sites Zone** (`Zones\4`).
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120bHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\120b
The 120b registry value controls the per-domain ActiveX prompt for the Restricted Sites Zone (Zones\4). It represents the URLACTION_ACTIVEX_OVERRIDE_DOMAINLIST URL action.
The value uses the REG_DWORD data type:
3enables the restriction. An installed ActiveX control can run without an additional per-domain prompt on the website that installed it. If another website in the zone attempts to use the control, the user is prompted and can allow it for the current website or for all websites.0disables the restriction. The per-site ActiveX prompt is suppressed, allowing installed ActiveX controls to be used from all websites in the zone.
This setting does not enable or block ActiveX controls as a whole. Whether a control can run still depends on other security-zone policies, the characteristics of the control, and other ActiveX protection mechanisms.
Notes
Security
A value of 3 prevents an unapproved website from using an installed ActiveX control without confirmation merely because that control was installed by another website.
A value of 0 removes this domain-based safeguard. If other settings permit ActiveX execution in the zone, an unapproved website can invoke an installed control without this additional user prompt. Controls that expose exploitable functionality or contain vulnerabilities may then increase the risk of unintended code execution or unauthorized access to local resources.
Possible side effects
A value of 3 can interrupt legacy web applications or introduce prompts when they use an ActiveX control installed by another domain. If ActiveX execution is already completely blocked for the zone, this setting has no visible effect by itself.
Notes
The HKLM location represents the computer policy scope, while the HKCU location represents the user policy scope. Both values apply only to the Restricted Sites Zone.
This setting belongs to the Internet Explorer security-zone architecture. Microsoft Edge does not support ActiveX on normally rendered pages. It can remain relevant to pages running in Microsoft Edge Internet Explorer mode, which supports ActiveX controls and Internet Explorer policies that affect security zones.
Microsoft documentation
Microsoft Learn: What is Internet Explorer mode?