Script ActiveX controls marked safe for scripting

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1405

The REG_DWORD value 1405 represents the URLACTION_SCRIPT_SAFE_ACTIVEX URL security action for the Restricted Sites zone. It determines whether scripts can interact with ActiveX controls whose publishers have marked them safe for scripting.

The supported value data has the following meaning:

• 0: Allow script interaction without prompting.
• 1: Ask the user before allowing script interaction.
• 3: Prevent script interaction.

The HKLM path provides the device-scoped policy value, while the HKCU path provides the corresponding user-scoped value.

Notes

Security

Allowing the interaction without prompting exposes the callable functionality of installed ActiveX controls to pages in the Restricted Sites zone. “Safe for scripting” is an assertion made by the control's developer. A vulnerable or incorrectly classified control can therefore still expose functionality that an untrusted script could misuse.

The potential impact is limited by the controls that are present, the operations they implement, and the permissions of the user running the browser process. This setting does not by itself grant administrative privileges, unrestricted file access, or general access to system resources.

A value of 3 blocks this form of scripted interaction. It does not uninstall the control or necessarily prevent the control from being used through other mechanisms.

Possible side effects

Blocking script interaction can break legacy web applications that depend on scripting an ActiveX control marked safe for scripting. A value of 1 introduces an interactive decision, which can interrupt unattended workflows or applications that cannot present or handle the prompt.

Notes

This setting does not independently permit ActiveX controls to run or be installed, and it does not enable active scripting. Other zone policies can still prevent either the control or the calling script from running.

ActiveX is a legacy technology. Microsoft Edge does not support ActiveX controls in its normal Chromium mode. Internet Explorer mode continues to support ActiveX controls and Internet Explorer policies that affect security-zone settings.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – Script ActiveX controls marked safe for scripting

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

Microsoft Learn: What is Internet Explorer mode?

See also

• Entry in the reference