Web sites in less privileged Web content zones can navigate into this zone

Purpose

Show registry keys (2)

• HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2101
• HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2101

This ADMX-backed Internet Explorer policy controls protection from zone elevation for navigations into the Restricted Sites zone. The value name 2101 identifies the URLACTION_FEATURE_ZONE_ELEVATION URL action (0x00002101).

The setting primarily applies to non-user-initiated navigation in which a page in a less privileged Web content zone opens a new window in the destination zone or navigates to an address in that zone. The underlying URL policy can allow the navigation, display a warning before proceeding, or block it.

Allowing the navigation removes the additional protection supplied by Internet Explorer's Protection from Zone Elevation feature for that navigation. Blocking it causes the feature to prevent the cross-zone navigation that Internet Explorer regards as potentially harmful.

Notes

Security

Allowing these navigations weakens the boundary between the participating security zones. A page in the source zone can initiate navigation whose destination is processed under the security rules of the Restricted Sites zone. Whether that provides any additional capability depends on the effective settings of both zones.

This setting does not by itself grant scripting, ActiveX, file-access, or other permissions to the source page. It also does not change a site's zone assignment. Those capabilities remain subject to their individual zone policies and other Internet Explorer security controls.

With the prompt option, navigation depends on the user's response to a security warning. Repeated or misleading prompts can reduce the effectiveness of this safeguard.

Possible side effects

Blocking can disrupt cross-zone redirects, script-initiated navigation, or the opening of new windows in legacy Web applications. This can particularly affect applications rendered by the Internet Explorer engine or by Microsoft Edge in Internet Explorer mode.

Notes

The HKLM variant applies at device scope, while the HKCU variant applies to the current user. Both use the value name 2101 under policy zone 4, which represents Restricted Sites.

This setting belongs to the Internet Explorer security-zone architecture. Microsoft Edge honors relevant Internet Explorer security-zone settings where the Internet Explorer engine is used, particularly in IE mode; it does not generally control ordinary pages rendered by the Chromium engine.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – RestrictedSitesZoneAllowLessPrivilegedSites

Microsoft Learn: What is Internet Explorer mode?

See also

• Entry in the reference