Initialize and script ActiveX controls not marked as safe
This ADMX-backed Group Policy setting controls whether ActiveX controls in the Trusted Sites zone may be initialized, loaded with parameters, and accessed by scripts when they are not marked as safe for untrusted data or scripting.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1201HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1201
This ADMX-backed Group Policy setting controls whether ActiveX controls in the Trusted Sites zone may be initialized, loaded with parameters, and accessed by scripts when they are not marked as safe for untrusted data or scripting.
The 1201 value uses the REG_DWORD type. Its policy values have the following meanings:
0: Object-safety checks are overridden. Affected ActiveX controls may be loaded and scripted without prompting the user.1: The user is prompted before a control is loaded with parameters or accessed by a script.3: ActiveX controls that cannot be made safe are not loaded with parameters or scripted.
Because the value is stored under Zones\2, it applies only to content assigned to the Trusted Sites zone.
Notes
Additional effects
With a value of 0, the setting applies to both unsafe and safe ActiveX controls. For this zone, it therefore overrides the separate setting that governs scripting of ActiveX controls marked safe for scripting.
This setting does not, by itself, permit arbitrary ActiveX control installation. Whether a control can be installed, run at all, or is blocked by another security mechanism can depend on additional ActiveX, add-on, and security-zone policies.
Security
A value of 0 bypasses an important object-safety check. A website in the Trusted Sites zone can initialize an installed ActiveX control with untrusted parameters or call functionality through scripts even though the control has not declared that interaction safe.
The resulting exposure depends on the control's capabilities and vulnerabilities and on the rights of the hosting process. A compromised or incorrectly trusted site might use such a control to disclose or modify data or perform other operations exposed by that control. The setting does not independently grant every site unrestricted system access.
A value of 1 leaves the decision to the user and therefore does not prevent approval caused by error or deception. A value of 3 reduces this attack surface by preventing controls that cannot be made safe from being loaded with parameters or scripted.
Possible side effects
A value of 3 can break legacy web applications that depend on an ActiveX control which is not correctly marked as safe. A value of 1 can produce recurring security prompts on affected pages.
Notes
The two registry locations represent the computer and user configurations of the same policy. The setting has an effect only in applications or compatibility modes that evaluate ActiveX and Internet Explorer security-zone policies. Microsoft Edge's normal Chromium mode does not run ActiveX controls, while Internet Explorer mode supports ActiveX and Internet Explorer policies affecting security zones.
Microsoft documentation
Microsoft Learn: InternetExplorer Policy CSP – TrustedSitesZoneInitializeAndScriptActiveXControls
Microsoft Learn: What is Internet Explorer (IE) mode?