Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Run .NET Framework-reliant components signed with Authenticode

This registry value controls whether Internet Explorer may execute Authenticode-signed, managed .NET Framework components originating from websites in the **Restricted Sites** zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2001
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2001

This registry value controls whether Internet Explorer may execute Authenticode-signed, managed .NET Framework components originating from websites in the Restricted Sites zone. These components include managed controls referenced by an HTML object tag and managed executables referenced by a link.

The value uses the REG_DWORD data type and the Internet Explorer URL policy values:

  • 0 allows execution without prompting.
  • 1 asks the user for a decision before execution.
  • 3 prevents execution.

When the policy is not configured, signed managed components are not executed in the Restricted Sites zone.

Notes

Security

A value of 0 permits code originating from a security zone intended for untrusted sites to execute. This reduces the protection normally provided by the Restricted Sites zone. A value of 1 delegates the decision to the user, whereas 3 blocks execution.

A valid Authenticode signature supports verification of the software publisher and the integrity of the signed code. It does not establish that the code is safe or free of malicious behavior. Signed components can therefore still present a risk, particularly when a signing certificate or its private key has been compromised or misused.

Possible side effects

Blocking execution can prevent legacy websites and browser-based applications from working correctly when they depend on managed controls or linked .NET Framework executables. Using the prompt value can instead produce recurring security prompts.

Notes

The HKLM and HKCU locations correspond to the device and user scopes of the ADMX-backed policy. This setting belongs to the Internet Explorer security-zone model; it does not generally control the execution of .NET applications outside that context.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode

Microsoft Learn: Authenticode digital signatures

See also