Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Initialize and script ActiveX controls not marked as safe

Registry value `1201` determines whether content in the Internet zone may initialize and script ActiveX controls whose developers have not marked them as safe for initialization with untrusted data or safe for scripting.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201

Registry value 1201 determines whether content in the Internet zone may initialize and script ActiveX controls whose developers have not marked them as safe for initialization with untrusted data or safe for scripting.

The value uses the REG_DWORD type. Its supported data values have the following meanings:

  • 0: The control may be loaded with parameters and scripted without prompting.
  • 1: The user is prompted before the control is loaded with parameters or scripted.
  • 3: Controls that cannot be made safe are not loaded with parameters or scripted.

Zone number 3 limits the setting to content assigned to the Internet zone.

Notes

Additional effects

With a value of 0, the setting permits the initialization and scripting of both unsafe and safe controls. For affected content, it overrides the separate zone setting named “Script ActiveX controls marked safe for scripting.”

Security

A safe-for-scripting or safe-for-initialization designation is an assertion by the control's developer that untrusted webpage content cannot misuse the relevant interfaces. A missing designation does not necessarily mean that the control is malicious, but the developer has not identified it as safe for that use.

A value of 0 allows an Internet-zone webpage to invoke an available unsafe ActiveX control without user confirmation. The resulting exposure depends on the control's capabilities. A malicious script might be able to read or modify local data, transfer information, or perform other operations in the security context of the signed-in user.

This setting does not install ActiveX controls or bypass every other protection. The control must already be available, the browser mode must support ActiveX, and other applicable policies must permit it to run. User permissions and additional security controls continue to limit what the control can do.

Possible side effects

A value of 3 can prevent legacy websites or line-of-business applications from working when they depend on loading an ActiveX control with parameters or scripting a control that is not marked as safe. A value of 1 makes these operations dependent on a user decision and can introduce additional security prompts.

Notes

HKCU holds the per-user policy value, while HKLM holds the per-device value. The effective setting depends on the policies that apply to the computer and user. The separate “Security Zones: Use only machine settings” policy can cause Internet Explorer components to use only the values under HKLM.

ActiveX is a legacy technology and is not supported in normal Microsoft Edge browsing. This setting can remain relevant to Microsoft Edge in Internet Explorer mode and to other components that use Internet Explorer security zones.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneInitializeAndScriptActiveXControls

Microsoft Learn: Internet Explorer security zones registry entries for advanced users

See also