Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Consistent Mime Handling

This machine-level Office policy controls the Internet Explorer `FEATURE_MIME_HANDLING` security feature separately for each listed executable.

since 0.9.8.11

Purpose

Show registry keys (14)
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\groove.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\excel.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\mspub.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\powerpnt.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\pptview.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\visio.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\winproj.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\winword.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\outlook.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\spdesign.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\exprwd.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\msaccess.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\onenote.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_mime_handling\mse7.exe

This machine-level Office policy controls the Internet Explorer FEATURE_MIME_HANDLING security feature separately for each listed executable. It takes effect when the corresponding process handles content through Internet Explorer or URLMon components.

When enabled, the feature checks whether the available file-type information is consistent. The comparison includes the file name extension, the HTTP Content-Type and Content-Disposition headers, and the content type detected from the file signature.

Each value name is a process-specific REG_DWORD. A value of 1 enables consistent MIME handling for that process; 0 disables it.

Notes

Additional effects

When the feature detects conflicting file-type information, it can rename the file, change its extension, and place it in the Internet Explorer cache. Subsequent handling therefore does not rely solely on the classification claimed by the web server or file name.

This setting is distinct from the separate “MIME Sniffing Safety Feature” (FEATURE_MIME_SNIFFING). MIME sniffing detects a content type from a file's signature; the feature documented here checks whether that result is consistent with the other available type information.

Security

Consistent MIME handling makes it more difficult to deliver executable or otherwise dangerous content under a harmless-looking MIME type or misleading file name extension. Without this check, affected processes can accept conflicting type information, increasing the possibility that a specially crafted download will be handled under a deceptive classification.

This feature is not malware scanning. It neither blocks every dangerous file nor replaces Microsoft Defender, SmartScreen, or the security checks performed by individual Office applications.

Possible side effects

Legitimate files from incorrectly configured web servers can be renamed or handled differently when their HTTP headers, file name extensions, and detected content types do not agree. A download might consequently appear under an unexpected name or fail to open or pass to an application as expected.

Notes

The specified key, which does not contain the Policies path component, is the process-specific Feature Control location used by the Office template. It must not be confused with the similarly named Internet Explorer policy under Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING.

Microsoft's current Office security-baseline reference lists onent.exe for the corresponding Office setting. The supplied value name onenote.exe is technically distinct and is therefore not treated as an interchangeable spelling.

Microsoft documentation

Microsoft Learn: Microsoft 365 Apps security baseline settings – Consistent Mime Handling

Microsoft Learn: INTERNETFEATURELIST enumeration – FEATURE_MIME_HANDLING

Microsoft Learn: InternetExplorer Policy CSP – ConsistentMimeHandlingInternetExplorerProcesses

See also