Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Initialize and script ActiveX controls not marked as safe

This security-zone policy controls whether ActiveX controls not marked as safe can be initialized, loaded with parameters, and accessed by scripts on pages in the **Restricted Sites** zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1201

This security-zone policy controls whether ActiveX controls not marked as safe can be initialized, loaded with parameters, and accessed by scripts on pages in the Restricted Sites zone. The 1201 value is a REG_DWORD representing this specific zone action:

  • 0 allows the action without prompting.
  • 1 prompts the user for a decision.
  • 3 prevents the action.

When the policy is not configured, controls that cannot be made safe are not loaded with parameters or scripted in this zone.

Notes

Additional effects

Unrestricted permission causes both safe and unsafe controls to be initialized and scripted. For these operations, it overrides the separate zone setting governing the scripting of ActiveX controls marked safe for scripting.

The policy does not install or download missing ActiveX controls. Other security policies and protection features can still prevent a control from being installed or run.

Security

A value of 0 bypasses the object-safety decision for untrusted data and scripts for this zone action. A webpage can consequently invoke functionality exposed by a control even though its publisher has not declared that use safe.

The actual consequences depend on the control involved. A defective or vulnerable control might expose or modify local data or permit code execution with the rights of the hosting process. Because Zones\4 represents the Restricted Sites zone, allowing the action without prompting specifically weakens a protection intended for restricted or untrusted content. It does not, by itself, grant administrative privileges or unrestricted access to every local file.

The prompt option does not eliminate the underlying technical risk: the control can still be used if the user approves the request.

Possible side effects

Preventing the action can break legacy web applications that need to load an ActiveX control not marked as safe with parameters or interact with it through script. The prompt option can interrupt such applications and make their operation dependent on a user decision.

Notes

The two registry locations represent the computer and user policy scopes of the same setting. The setting affects only content that an application assigns to the Restricted Sites zone and processes through the Internet Explorer security-zone model.

Microsoft Edge does not support ActiveX in its normal Chromium mode. Internet Explorer mode does support ActiveX controls and Internet Explorer policies affecting security-zone settings, so this policy can remain relevant to sites opened in IE mode.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneInitializeAndScriptActiveXControls

Microsoft Learn: What is Internet Explorer mode?

See also