Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Protection From Zone Elevation

This machine-level Office policy controls the Internet Explorer `FEATURE_ZONE_ELEVATION` security feature separately for the listed executables.

since 0.9.8.11

Purpose

Show registry keys (14)
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\groove.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\excel.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\mspub.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\powerpnt.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\pptview.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\visio.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\winproj.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\winword.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\outlook.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\spdesign.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\exprwd.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\msaccess.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\onenote.exe
  • HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION\mse7.exe

This machine-level Office policy controls the Internet Explorer FEATURE_ZONE_ELEVATION security feature separately for the listed executables. A REG_DWORD value of 1 opts the process whose executable name matches the value name into zone-elevation protection.

The feature applies to web content processed by that application through the Internet Explorer platform or the WebBrowser control. It prevents navigation that was not initiated by the user from moving content out of a less privileged security zone into a context with fewer restrictions. The effective decision also depends on the URLACTION_FEATURE_ZONE_ELEVATION policy assigned to the Internet Explorer security zones involved.

Each value applies only to the process named by that value. It does not generally restrict execution of the Office application or govern every link and document opened by the application.

Notes

Additional effects

Zone-elevation protection also disables JavaScript navigation when no security context is available.

Security

Internet Explorer security zones apply different restrictions according to the origin of web content. In particular, the Local Machine zone has traditionally imposed fewer restrictions than the Internet and Restricted Sites zones. Without zone-elevation protection, specially crafted web content could attempt to use automatic cross-zone navigation to reach a less restricted context.

The setting reduces that risk within the selected Office processes. It does not grant or revoke Windows user rights, alter file-system permissions, or provide general application or process isolation.

Possible side effects

Legitimate embedded web content or legacy Office extensions can be affected if they depend on automatic navigation across security-zone boundaries. JavaScript navigation for which no security context can be determined can also be blocked. Other navigation and Office functionality are not necessarily affected.

Notes

These are application-specific feature-control values under HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl. They are distinct from the similarly named Windows policy for Internet Explorer processes, whose ADMX mapping uses Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION.

The feature is relevant only when the named application uses components of the Internet Explorer platform or hosts the WebBrowser control. It is not a general protection mechanism for unrelated browser engines.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – Protection From Zone Elevation

Microsoft Learn: INTERNETFEATURELIST enumeration

Microsoft Learn: Guidance for securing applications that host the WebBrowser control

See also