Security Zones: Use only machine settings
`Security_HKLM_only` is a machine-wide `REG_DWORD` value.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only
Security_HKLM_only is a machine-wide REG_DWORD value. When its value is 1, Windows obtains security-zone information exclusively from the machine settings under HKEY_LOCAL_MACHINE. Per-user zone settings stored under HKEY_CURRENT_USER are not used when the effective configuration is evaluated.
Consequently, every user of the computer receives the same site-to-zone mappings and zone-dependent security options. Security zones group websites by security level. Applications and Windows components can use the resulting zone to determine whether a zone-controlled action is allowed, blocked, or requires confirmation.
Notes
Security
This value does not assign websites to zones or make any zone more or less restrictive by itself. Its security impact depends entirely on the machine-level security-zone configuration.
A centrally defined restrictive configuration can prevent per-user settings from weakening the intended protection. Conversely, stricter settings created by an individual user are also disregarded. An incorrect or overly broad machine configuration therefore affects every user of the computer.
Zone settings can influence decisions involving Windows Integrated Authentication, file downloads, and Internet Explorer mode. The actual effect depends on the application consuming the zone information and on the other zone policies in force.
Possible side effects
User-specific changes to security zones do not affect the configuration that Windows applies. Applications that consume Windows security-zone information may therefore classify sites or handle zone-dependent features differently from what a user expects.
Microsoft Edge uses Windows Security Zones for only a limited set of decisions, including Windows Integrated Authentication, certain download behavior, and Internet Explorer mode. This value does not make Microsoft Edge adopt every zone-dependent behavior formerly implemented by Internet Explorer.
Notes
This setting is distinct from the separate “Security Zones: Do not allow users to change policies” policy. Security_HKLM_only selects whether machine or per-user settings are evaluated; the other policy restricts changes through the user interface.
Microsoft documentation
Microsoft Learn: InternetExplorer Policy CSP – SecurityZonesUseOnlyMachineSettings
Microsoft Learn: Intranet site is identified as an Internet site
Microsoft Learn: Per-site configuration by policy