Intranet Sites: Include all network paths (UNCs)
This ADMX-backed Group Policy setting determines whether URLs representing UNC network paths are automatically mapped to the **Local intranet** security zone.
since 0.9.8.11
Purpose
Show registry keys (2)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranetHKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet
This ADMX-backed Group Policy setting determines whether URLs representing UNC network paths are automatically mapped to the Local intranet security zone.
When the policy is enabled, all recognized UNC network paths are mapped to that zone. When it is disabled, this setting does not automatically map network paths to the Local intranet zone, although other zone-mapping rules can still do so. If the policy is not configured, users can control the corresponding zone-detection option.
The mapping affects only Windows components and applications that evaluate Windows Security Zones or use Internet Explorer Security Manager. Within those components, the security and authentication settings of the Local intranet zone apply to the mapped path.
Notes
Additional effects
A Windows Security Zone can affect whether an application displays a warning or blocks a file opened from a network location. Microsoft Edge also continues to use Windows Security Zones for a limited set of decisions, including Windows Integrated Authentication, file-download handling, and Internet Explorer mode.
The policy does not modify share or NTFS permissions, grant access to network resources, or establish a network connection. It also does not make a server universally trusted outside processing that depends on its security-zone classification.
Security
The Local intranet zone can be configured less restrictively than the Internet zone. Mapping every UNC path to the Local intranet zone can therefore give paths hosted by untrusted or attacker-controlled network servers the benefit of less restrictive zone settings. Depending on the other zone policies, this can affect security prompts, active-content handling, or credential release by components that consult the zone classification.
The actual exposure depends on the Local intranet zone configuration and the application processing the path. This policy by itself does not bypass access controls or provide additional file or system permissions.
Possible side effects
Applications that use Internet Explorer Security Manager can handle files on UNC shares differently. Security warnings or blocks may no longer appear. Conversely, disabling the mapping can cause applications to treat network files as Internet content, resulting in additional warnings or preventing files from opening.
Notes
The value can exist in both the computer and user registry branches. The HKLM value represents Computer Configuration, while the HKCU value represents User Configuration.
The notation used for a network target can still affect zone detection despite the policy's broad description. Microsoft documents that shares addressed by a fully qualified domain name or an IP address can continue to be classified in the Internet zone, particularly when the address contains periods. The policy therefore does not guarantee identical classification for every UNC representation.
Microsoft documentation
Microsoft Learn: InternetExplorer Policy CSP — IncludeAllNetworkPaths
Microsoft Learn: Intranet site is identified as an Internet site
Microsoft Learn: Per-site configuration by policy