Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Web sites in less privileged Web content zones can navigate into this zone

The `2101` value controls the `URLACTION_FEATURE_ZONE_ELEVATION` URL action for the Internet zone, represented by zone key `3`.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2101
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2101

The 2101 value controls the URLACTION_FEATURE_ZONE_ELEVATION URL action for the Internet zone, represented by zone key 3. It determines whether a site in a less privileged zone, such as the Restricted Sites zone, may open a new window in or initiate navigation into the Internet zone.

The value uses the REG_DWORD type and accepts these action values:

  • 0: Allow the navigation without prompting
  • 1: Prompt the user before allowing the navigation
  • 3: Block the navigation

When the associated policy is not configured, Internet Explorer allows the navigation by default. The HKLM path represents device policy, while the HKCU path represents user policy.

Notes

Security

Allowing the navigation removes the additional protection supplied by Internet Explorer's Protection from Zone Elevation feature for this zone transition. Content in a more restricted zone can consequently initiate navigation to content that is processed under the less restrictive rules of the Internet zone.

This value does not reclassify the originating site as an Internet-zone site or grant it general access to data and resources in that zone. It controls only whether the site can initiate the relevant transition by navigating or opening a new window.

A value of 3 blocks these potentially risky navigations when Protection from Zone Elevation is active for the process. A value of 1 leaves the decision to the user after displaying a warning and therefore provides less consistent protection than blocking the transition.

Possible side effects

Blocking the transition can affect legacy web applications that intentionally open Internet-zone pages from content assigned to a more restricted zone. The prompt option can interrupt automated workflows or produce additional warnings when windows and links are opened.

Notes

This setting belongs to the Internet Explorer web platform. It can remain relevant to pages running in Microsoft Edge Internet Explorer mode because IE-mode tabs evaluate Windows Security Zones and their URL-action policies. It does not generally control navigation between sites in regular Microsoft Edge tabs.

Microsoft documents this ADMX-backed policy for device and user scope on Windows 10, version 1703 and later. Although the Internet Explorer 11 desktop application is no longer supported on many Windows versions, the setting can still affect Internet Explorer mode.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – InternetZoneAllowLessPrivilegedSites

Microsoft Learn: Per-site configuration by policy – Windows Security Zones and IE mode

Microsoft Learn: URL Policy Flags

See also