Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Run ActiveX controls and plug-ins

These policy values determine whether ActiveX controls and plug-ins may run on pages assigned to the Internet Explorer **Restricted Sites** security zone (zone `4`).

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200

These policy values determine whether ActiveX controls and plug-ins may run on pages assigned to the Internet Explorer Restricted Sites security zone (zone 4). The value name 1200 identifies the corresponding URL security action.

The value uses the REG_DWORD data type. Supported data values have the following effects:

  • 0: Controls and plug-ins may run without user intervention.
  • 1: The user is prompted to decide whether they may run.
  • 3: Controls and plug-ins are prevented from running.

When the associated policy is not configured, ActiveX controls and plug-ins are also prevented from running in this zone.

Notes

Security

A value of 0 removes an important protection from the Restricted Sites zone. A page assigned to that zone can invoke an eligible, already available ActiveX control without first obtaining the user's consent. Web content could consequently exploit a vulnerability or dangerous capability in such a control.

A value of 1 leaves the decision to the user. Although this preserves a confirmation prompt, deceptive or manipulated content might persuade the user to approve execution.

This setting does not grant an ActiveX control administrative privileges. The possible impact depends on the control and on the permissions of the hosting process and signed-in user. It also does not override separate restrictions governing ActiveX installation, signature validation, initialization, or scripting.

Possible side effects

A value of 3 can prevent legacy web applications from working when they depend on ActiveX controls or plug-ins. With a value of 1, repeated security prompts can interrupt application workflows or prevent unattended operation.

Notes

The HKLM path represents the computer-scoped policy value, while the HKCU path represents the user-scoped variant. Both apply only to security zone 4.

The Chromium engine in Microsoft Edge does not support ActiveX. This setting can nevertheless remain relevant to pages loaded in Microsoft Edge using Internet Explorer mode and its Trident/MSHTML engine. IE mode supports ActiveX and Internet Explorer policies that affect security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneRunActiveXControlsAndPlugins

Microsoft Learn: What is Internet Explorer (IE) mode?

Microsoft Learn: URL Policy Flags

See also