Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Local Machine Zone Lockdown Security

This machine-level Office policy controls the Internet Explorer feature control named `FEATURE_LOCALMACHINE_LOCKDOWN` individually for the listed executables.

since 0.9.8.11

Purpose

Show registry keys (14)
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\groove.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\excel.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\mspub.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\powerpnt.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\pptview.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\visio.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\winproj.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\winword.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\outlook.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\spdesign.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\exprwd.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\msaccess.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\onenote.exe
  • HKLM\software\microsoft\internet explorer\main\featurecontrol\feature_localmachine_lockdown\mse7.exe

This machine-level Office policy controls the Internet Explorer feature control named FEATURE_LOCALMACHINE_LOCKDOWN individually for the listed executables. It applies when one of those processes handles local web content through Internet Explorer or MSHTML components.

Each value is a REG_DWORD. A value of 1 enables the lockdown feature for the corresponding process, while 0 disables it. When lockdown is active, content in the Local Machine zone is subject to the security rules defined for the Locked-Down Local Machine zone. The content retains its original zone assignment; the feature applies an additional set of zone restrictions.

The resulting restrictions depend on the Locked-Down Local Machine zone settings. They can govern scripting, ActiveX controls, Java components, file downloads, and other URL actions. This feature does not constitute a general Office file block and does not control VBA macros or Protected View.

Notes

Security

Local HTML and other active web content has historically received the privileges of the Local Machine zone. Lockdown limits the opportunity for malicious or modified content to exploit that trust after reaching local storage or while being processed locally by an Office application.

The protection is process-specific and applies only to executables whose corresponding values enable the feature. It also does not unconditionally block every form of active content. The effective restrictions are determined by the Locked-Down Local Machine zone rules and by how the application hosts or renders the content.

Possible side effects

Legitimate local web content may no longer render completely or may lose functionality. Depending on the zone rules, scripts, ActiveX-based components, embedded web interfaces, or automatic downloads can be blocked or can produce security notifications. Legacy Office extensions and solutions built around the Internet Explorer WebBrowser control or MSHTML are the most likely to be affected.

Notes

The registry value names identify executable processes. Each value affects only the matching process name; entries for applications that are absent or unused have no practical effect.

Microsoft's current security-baseline reference lists onent.exe under this policy, whereas the registry data documented here explicitly contains onenote.exe. These are distinct value names: an entry for onenote.exe does not apply to a process named onent.exe, or vice versa.

Microsoft documentation

Microsoft Learn: Microsoft 365 Apps for Enterprise security baseline settings reference

Microsoft Learn: InternetExplorer Policy CSP and Locked-Down Local Machine zone settings

Microsoft Learn: INTERNETFEATURELIST enumeration

See also