Allow script-initiated windows without size or position constraints

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2102
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2102

The REG_DWORD value 2102 controls the URLACTION_FEATURE_WINDOW_RESTRICTIONS URL action for the Internet zone, identified by zone key 3. It determines whether scripts may open and manipulate windows without the additional size, position, and presentation restrictions imposed by Internet Explorer.

A value of 0 permits unrestricted window operations. Script-initiated windows may consequently be positioned outside the fully viewable desktop area, and the security feature's restrictions on window size, position, and status-bar presentation do not apply.

A value of 3 disallows the URL action. Window restrictions therefore remain in effect for the Internet zone when FEATURE_WINDOW_RESTRICTIONS is enabled for the process. Windows are then constrained to the viewable desktop area, and chromeless pop-up windows cannot be freely sized or positioned to cover important information in their parent windows or in system dialog boxes.

Notes

Security

Allowing unrestricted script-initiated windows removes a layer of protection against deceptive window presentation. A website in the Internet zone can arrange or size windows so that trusted interface elements are obscured or its own content overlays other windows. This can facilitate spoofing and other attempts to mislead the user.

This setting does not grant scripts additional operating-system privileges or general access to files, the registry, or storage devices. It also does not independently enable scripting or permit pop-up windows. Those capabilities must already be allowed by the applicable security-zone and process policies.

Possible side effects

When window restrictions are enforced, legacy web applications that depend on pop-up windows with exact dimensions or screen coordinates may not behave as designed. Their windows can be repositioned, constrained in size, or displayed with additional browser chrome.

Notes

The setting applies only to content assigned to the Internet zone. The two registry locations represent the computer and user policy scopes, respectively.

This setting belongs to the Internet Explorer security-zone architecture. It can remain relevant to pages loaded by the MSHTML engine in Microsoft Edge Internet Explorer mode. It does not control the window behavior of regular Edge pages rendered by the Chromium engine.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneAllowScriptInitiatedWindows

Microsoft Learn: URL Action Flags – URLACTION_FEATURE_WINDOW_RESTRICTIONS

See also

• Entry in the reference