Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Run .NET Framework-reliant components not signed with Authenticode

The `2004` registry value controls the `URLACTION_MANAGED_UNSIGNED` (`0x00002004`) URL security action for Internet Explorer's Restricted Sites zone.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2004
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2004

The 2004 registry value controls the URLACTION_MANAGED_UNSIGNED (0x00002004) URL security action for Internet Explorer's Restricted Sites zone. It determines whether unsigned managed components that depend on the .NET Framework may run. The affected content includes managed controls referenced by an object element and managed executables referenced by a link.

The value is stored as REG_DWORD. Its data represents the following Internet Explorer URL policy states:

  • 0 allows the component to run without prompting.
  • 1 asks the user whether the component may run.
  • 3 prevents the component from running.

When the policy is not configured, Internet Explorer does not run these unsigned managed components in the Restricted Sites zone by default.

Notes

Security

A value of 0 permits sites in this highly restricted security zone to execute unsigned managed code. Because the component has no Authenticode signature, Authenticode cannot establish its publisher or verify that its contents have remained unchanged. Allowing the component therefore increases exposure to malicious or modified code referenced by a site in this zone.

A value of 1 does not block execution unconditionally; it places the decision with the user. Its protection consequently depends on that decision and can be weakened by misleading prompts. A value of 3 blocks this category of managed component.

Allowing the URL action does not bypass other access checks or security controls. In particular, it does not grant general administrative privileges or authorize every type of .NET application to run.

Possible side effects

A value of 3 can prevent legacy web applications from working when they depend on unsigned managed controls or linked .NET executables. A value of 1 can interrupt their operation with security prompts and make execution dependent on user interaction.

Notes

This setting applies only to content that Internet Explorer assigns to the Restricted Sites zone, identified by zone number 4. It does not control signed .NET Framework components or .NET applications outside this URL security mechanism. Signed managed components are governed by a separate URL action.

The HKLM and HKCU locations represent the computer and user forms of the same ADMX-backed policy. The setting belongs to Internet Explorer's legacy security-zone model, so its practical effect depends on whether Internet Explorer-based content is still used on the system.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneAllowNETFrameworkReliantComponents

Microsoft Learn: URL Action Flags

Microsoft Learn: URL Policy Flags

See also