Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Run .NET Framework-reliant components not signed with Authenticode

This zone-specific registry value represents the `URLACTION_MANAGED_UNSIGNED` (`0x00002004`) URL security action for the Internet zone (`Zones\3`).

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2004

This zone-specific registry value represents the URLACTION_MANAGED_UNSIGNED (0x00002004) URL security action for the Internet zone (Zones\3). It determines whether Internet Explorer may execute managed, .NET Framework-reliant components that are not signed with Authenticode. These components include managed controls referenced by an object element and managed executables referenced by a link.

The value uses the REG_DWORD data type. Its supported data values have the following effects:

  • 0 (URLPOLICY_ALLOW): The component may run without prompting the user.
  • 1 (URLPOLICY_QUERY): The user is prompted to decide whether the component may run.
  • 3 (URLPOLICY_DISALLOW): Execution is blocked.

Notes

Security

A value of 0 allows websites in the Internet zone to run unsigned managed components without prompting. Without an Authenticode signature, Authenticode cannot verify the publisher's identity or establish that signed content has remained unchanged since it was signed. Allowing such components therefore increases exposure to malicious web content and vulnerabilities in managed components.

A value of 1 prevents silent execution but transfers the decision to the user. Approving the prompt permits that execution. A value of 3 blocks this execution path and reduces the attack surface associated with unsigned managed code originating from the Internet zone.

This setting does not grant administrative privileges or override Windows file, process, or other access controls. Permitted code still runs under the applicable process and user context and remains subject to other effective security restrictions.

Possible side effects

A value of 3 can prevent legacy websites or web applications from working when they depend on unsigned managed controls or linked .NET executables. A value of 1 can interrupt these applications with security prompts and makes their operation dependent on the user's response.

Notes

This setting applies only to the Internet zone, identified by zone number 3. The Local intranet, Trusted sites, Restricted sites, and locked-down zones use separate registry paths. It does not control the general execution of local .NET applications or every mechanism for downloading or launching executable files.

The HKLM path represents the computer policy scope, while the HKCU path represents the user policy scope. For the corresponding ADMX policy, Microsoft documents that unsigned managed components are executed in the Internet zone when the policy is not configured.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneAllowNETFrameworkReliantComponents

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

See also