Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation · Policy appendix

Edge and Internet Explorer

Every setting of the “Edge and Internet Explorer” package with its effect, value and recommending sources.

since 0.9.8.11

Purpose

This page lists every setting of the “Edge and Internet Explorer” package: what it does, which value Setup Foundry sets and who recommends it. It is generated from the catalog and never edited by hand.

133 settings.

Notes

Allow only approved domains to use ActiveX controls without prompt

The 120b registry value controls the per-domain ActiveX prompt for the Restricted Sites Zone (Zones\4). It represents the URLACTION_ACTIVEX_OVERRIDE_DOMAINLIST URL action.

Prevent per-user installation of ActiveX controls

This policy prevents ActiveX controls from being installed on a per-user basis. When enabled, an ActiveX control cannot be installed solely for the current user account. When disabled or not configured, per-user installation remains available.

Userdata persistence

This setting controls user data persistence for webpages in the Internet zone. It determines whether Internet Explorer may preserve information in browser history, favorites, an XML store, or directly within a webpage saved to disk.

Allow only approved domains to use the TDC ActiveX control

This setting controls whether websites in the Restricted Sites security zone can run the Internet Explorer Tabular Data Control (TDC). TDC is an ActiveX control that enables webpages to load data from text files and bind it to HTML elements such as tables and form controls.

Don't run antimalware programs against ActiveX controls

The 270C value determines whether Internet Explorer consults an integrated antimalware program before creating an instance of an ActiveX control for a page in the Restricted Sites zone.

Don't run antimalware programs against ActiveX controls

This policy determines whether Internet Explorer consults an antimalware program before creating an instance of an ActiveX control for a page in the Trusted Sites zone.

Don't run antimalware programs against ActiveX controls

The REG_DWORD value 270C controls antimalware checking of ActiveX controls for webpages in the Internet zone. Zone number 3 identifies the Internet zone.

Don't run antimalware programs against ActiveX controls

The 270C value controls whether Internet Explorer consults an antimalware program before creating an instance of an ActiveX control. It applies only to pages assigned to the Local intranet zone (Zones\1).

Don't run antimalware programs against ActiveX controls

This registry value determines whether Internet Explorer consults an antimalware program before creating an instance of an ActiveX control for content in the Local Machine zone.

Script ActiveX controls marked safe for scripting

The REG_DWORD value 1405 represents the URLACTION_SCRIPT_SAFE_ACTIVEX URL security action for the Restricted Sites zone. It determines whether scripts can interact with ActiveX controls whose publishers have marked them safe for scripting.

Run ActiveX controls and plug-ins

These policy values determine whether ActiveX controls and plug-ins may run on pages assigned to the Internet Explorer Restricted Sites security zone (zone 4). The value name 1200 identifies the corresponding URL security action.

Allow scriptlets

The 1209 value controls the URLACTION_ACTIVEX_SCRIPTLET_RUN URL security action for the Internet zone. It determines whether Internet Explorer may run DHTML scriptlets. Scriptlets are a legacy, Internet Explorer-specific component technology for reusable scripted content; this setting does not control JavaScript or VBScript execution in general.

Automatic prompting for file downloads

This setting controls how Internet Explorer, or the Internet Explorer engine, responds to file downloads that were not initiated by an explicit user action when the originating page belongs to the Restricted Sites zone.

Internet Explorer Processes

This policy controls the Internet Explorer security feature FEATURE_RESTRICT_ACTIVEXINSTALL for the Internet Explorer processes identified by the administrative template. When the restriction is enabled, those processes block prompts to install ActiveX controls. This includes pages that instantiate an ActiveX control that is not installed or request installation of an updated control.

Internet Explorer Processes

This policy controls the Internet Explorer security feature FEATURE_RESTRICT_ACTIVEXINSTALL for the Internet Explorer processes identified by the administrative template. When the restriction is enabled, those processes block prompts to install ActiveX controls. This includes pages that instantiate an ActiveX control that is not installed or request installation of an updated control.

Logon options

The 1A00 value represents the URLACTION_CREDENTIALS_USE security setting for the Internet Zone, which has zone identifier 3. It is a REG_DWORD value that determines how Windows components use credentials for resources assigned to that zone.

Automatic prompting for file downloads

This policy controls how the Internet zone handles file downloads that were not initiated by an explicit user action, such as a mouse click or keystroke.

Allow META REFRESH

This policy controls whether pages in the Internet Explorer Restricted Sites zone may use an active Meta Refresh element to reload automatically or redirect the browser to another webpage.

Prevent downloading of enclosures

This Administrative Templates policy prevents the Windows Feed Sync Engine from downloading enclosures from RSS feeds to the computer. An enclosure is a file referenced by an RSS enclosure element.

Allow binary and script behaviors

This value controls whether dynamic binary and script behaviors may run for content in the Restricted Sites security zone. These behaviors are components that attach functionality to HTML elements. The value name 2000 represents the URLACTION_BEHAVIOR_RUN URL security action.

Allow drag and drop or copy and paste files

This Internet Explorer policy controls whether users can drag files or copy and paste files from a source assigned to the Restricted Sites zone. Zone number 4 identifies that security zone, while value name 1802 represents file drag-and-drop and copy-and-paste operations.

Allow drag and drop or copy and paste files

This policy controls the URLACTION_SHELL_MOVE_OR_COPY URL security action (0x00001802) for sources assigned to the Internet zone. It determines whether users may transfer files from such a source by dragging and dropping them or by copying and pasting them.

Allow file downloads

This policy controls the file-download URL security action for the Restricted Sites Zone. The final identifier, 1803, is the name of a REG_DWORD value representing URLACTION_SHELL_FILE_DOWNLOAD.

Internet Explorer Processes

This policy controls consistent MIME handling in Windows Explorer and Internet Explorer processes. Internet Explorer compares several indicators for the type of a file received from a web server: the file name extension, the HTTP Content-Type and Content-Disposition headers, and the type detected by examining the file signature.

Internet Explorer Processes

This policy controls consistent MIME handling in Windows Explorer and Internet Explorer processes. Internet Explorer compares several indicators for the type of a file received from a web server: the file name extension, the HTTP Content-Type and Content-Disposition headers, and the type detected by examining the file signature.

Userdata persistence

This setting controls the URLACTION_HTML_USERDATA_SAVE URL action (0x00001606) for the Restricted Sites Zone (zone 4). It determines whether content in that zone may persist information in browser history, favorites, an XML store, or directly within a web page saved to disk. When a persisted page is opened again, its previously stored state can be restored.

Navigate windows and frames across different domains

The 1607 REG_DWORD value controls the URLACTION_HTML_SUBFRAME_NAVIGATE URL action for the Restricted Sites zone (Zones\4). It determines whether web content in that zone may open or navigate windows and frames across domain boundaries.

Access data sources across domains

This security-zone policy controls cross-domain data access through Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO) for content in the Internet Zone. The 3 in the registry path identifies the Internet Zone, while the value name 1406 represents the URLACTION_CROSS_DOMAIN_DATA URL action.

Access data sources across domains

The 1406 value controls the URLACTION_CROSS_DOMAIN_DATA URL action for the Restricted Sites Zone. It determines whether a page running in this zone can use Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO) to access a data source on another domain.

Enable dragging of content from different domains across windows

This REG_DWORD value controls whether the Internet Explorer security-zone model permits users to drag content between different domains when the source and destination are in separate windows. The Zones\4 key limits the setting to the Restricted Sites zone.

Enable dragging of content from different domains within a window

This ADMX-backed Internet Explorer policy controls whether users can drag content between different domains when the source and destination are in the same browser window. It applies only to sites in the Restricted Sites Zone, represented by the Zones\4 subkey.

Navigate windows and frames across different domains

This setting controls the URLACTION_HTML_SUBFRAME_NAVIGATE URL security action for the Internet zone. It determines whether windows and embedded frames may navigate to content in a different domain.

Download signed ActiveX controls

This policy controls the downloading of signed ActiveX controls from webpages assigned to the Internet zone. Registry value 1001 is the URLACTION_DOWNLOAD_SIGNED_ACTIVEX URL action and uses the REG_DWORD data type.

Download unsigned ActiveX controls

This policy controls whether a page in the Internet zone may download an unsigned ActiveX control. Registry value 1004 represents the URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URL action, while zone number 3 identifies the Internet zone.

Enable Application Bound Encryption

A DWORD value of 1 enables Application Bound Encryption in Microsoft Edge. Edge then binds the encryption keys used for local data storage to the browser whenever possible. This binding is intended to prevent other applications from readily retrieving and using those keys outside Edge.

Allow Basic authentication for HTTP

This value is a device-wide Microsoft Edge policy stored as REG_DWORD. A value of 0 disables Basic authentication over nonsecure HTTP: Microsoft Edge blocks affected authentication requests and permits Basic authentication only over HTTPS.

Show the Reload in Internet Explorer mode button in the toolbar

This REG_DWORD value controls whether Microsoft Edge shows the Reload in Internet Explorer mode button on the toolbar by default.

Specifies whether SharedArrayBuffers can be used in a non cross-origin-isolated context

This value controls whether websites in Microsoft Edge may use SharedArrayBuffer outside a cross-origin-isolated context. SharedArrayBuffer provides web applications with a binary memory region that can be accessed by multiple execution contexts.

Enable site isolation for every site

This computer-level Microsoft Edge policy is represented by a REG_DWORD value. A value of 1 enforces the browser's default site-isolation behavior, under which content from different sites runs in separate renderer processes. Users cannot opt out through experimental Edge settings.

Configure Microsoft Defender SmartScreen

The SmartScreenEnabled value enables Microsoft Defender SmartScreen in Microsoft Edge. Its data type is REG_DWORD; a value of 1 turns the feature on and enforces the setting for the Edge installation on the computer. Users cannot then disable SmartScreen through the browser settings.

Configure Microsoft Defender SmartScreen to block potentially unwanted apps

This registry value enables Microsoft Defender SmartScreen protection against potentially unwanted apps (PUAs) in Microsoft Edge. When the DWORD value is set to 1, Edge warns about relevant downloads and blocks downloads and associated resource URLs that SmartScreen identifies as potentially unwanted.

Configure Edge Website Typo Protection

TyposquattingCheckerEnabled controls Edge Website Typo Protection. When the mandatory machine-level registry value is set to 1 as a REG_DWORD, Microsoft Edge keeps the feature enabled and does not allow users to turn it off.

Enable browser legacy extension point blocking

This value is a Boolean REG_DWORD. A value of 1 causes Microsoft Edge to apply the Windows ProcessExtensionPointDisablePolicy mitigation to its browser process. The mitigation blocks legacy Windows extension points through which third-party applications could load code into that process.

Dynamic Code Settings

A value of 1 (EnabledForBrowser) prevents the Microsoft Edge browser process from creating dynamic code. The registry value uses the REG_DWORD type.

Automatically open downloaded MHT or MHTML files from the web in Internet Explorer mode

Setting this REG_DWORD value to 0 disables the automatic routing of MHT and MHTML files downloaded from the web to Internet Explorer mode. Microsoft Edge therefore does not automatically open these files with the IE mode engine.

Allow unconfigured sites to be reloaded in Internet Explorer mode

This value is a Boolean Microsoft Edge policy represented as REG_DWORD. A value of 0 disables manual reloading of unconfigured sites in Internet Explorer mode.

Allow software WebGL fallback using SwiftShader

This DWORD registry value controls whether Microsoft Edge may use SwiftShader as a software-based WebGL fallback when hardware GPU acceleration is unavailable.

Turn on Enhanced Protected Mode

This policy controls Internet Explorer Enhanced Protected Mode. When enabled, it applies Enhanced Protected Mode to every security zone in which Protected Mode is already active. It does not independently enable Protected Mode for zones where that underlying protection is turned off.

Allow scripting of Internet Explorer WebBrowser controls

This setting determines whether pages in the Internet zone can use script to control an embedded Internet Explorer WebBrowser control. The WebBrowser control is an ActiveX component through which applications can host web content using Internet Explorer and MSHTML technology.

Turn on Protected Mode

This policy controls Protected Mode for websites in the Internet zone in Internet Explorer and for applicable content running in Microsoft Edge IE mode. Protected Mode runs web content at low integrity, limiting the file-system and registry locations to which the affected process can write.

Turn on Protected Mode

This policy controls Protected Mode for the Restricted Sites security zone (zone 4). Protected Mode limits the registry and file-system locations to which content handled by Internet Explorer can write. These restrictions reduce the potential impact of an exploited browser or website vulnerability.

Allow script-initiated windows without size or position constraints

This Internet Explorer security-zone policy determines whether scripted-window security restrictions apply to sites in the Restricted Sites zone. The value name 2102 represents the URLACTION_FEATURE_WINDOW_RESTRICTIONS URL action.

Allow script-initiated windows without size or position constraints

The REG_DWORD value 2102 controls the URLACTION_FEATURE_WINDOW_RESTRICTIONS URL action for the Internet zone, identified by zone key 3. It determines whether scripts may open and manipulate windows without the additional size, position, and presentation restrictions imposed by Internet Explorer.

Download signed ActiveX controls

The 1001 REG_DWORD value controls whether a signed ActiveX control may be downloaded from a page assigned to the Restricted Sites Zone. Windows evaluates the zone of the HTML page containing the control, rather than assigning the decision solely from the control’s download location.

Download unsigned ActiveX controls

The 1004 REG_DWORD value controls the downloading of unsigned ActiveX controls for websites in the Restricted Sites zone (Zones\4). It represents the URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URL action.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the MIME Sniffing Safety Feature for the specified Explorer and Internet Explorer processes. MIME sniffing examines a file’s binary signature to determine its actual content type, which Internet Explorer can then use when deciding how to render or otherwise handle the file.

Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows

This policy determines whether Internet Explorer 11 uses 64-bit or 32-bit tab processes while running in Enhanced Protected Mode on 64-bit versions of Windows.

Internet Explorer Processes

This policy controls whether Internet Explorer processes display the Notification bar when an Internet Explorer security feature restricts a file or code installation.

Internet Explorer Processes

This policy controls whether Internet Explorer processes display the Notification bar when an Internet Explorer security feature restricts a file or code installation.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the MIME Sniffing Safety Feature for the specified Explorer and Internet Explorer processes. MIME sniffing examines a file’s binary signature to determine its actual content type, which Internet Explorer can then use when deciding how to render or otherwise handle the file.

Java permissions

This ADMX-backed Internet Explorer policy sets the permission level for Java applets in the Restricted Sites zone. The 1C00 DWORD value represents the URLACTION_JAVA_PERMISSIONS URL action.

Java permissions

The 1C00 REG_DWORD value determines the permission level for Java applets in the Locked-Down Trusted Sites Zone. It represents the URLACTION_JAVA_PERMISSIONS URL action.

Java permissions

The 1C00 DWORD value determines the permission level for Java applets in the Internet zone. It represents the URLACTION_JAVA_PERMISSIONS URL action.

Java permissions

The 1C00 registry value selects the permission level for Java applets in the Local Intranet zone. It represents the URLACTION_JAVA_PERMISSIONS URL action and applies only to content classified by Windows as belonging to that zone (Zones\1).

Java permissions

The 1C00 registry value determines the permission level for Java applets in the Locked-Down Local Machine Zone. This zone is the restricted counterpart of the regular Local Machine Zone. Internet Explorer lockdown features compare the settings of the active security zone with those of its locked-down equivalent.

Java permissions

The 1C00 REG_DWORD value determines the permissions granted to Java applets in the Locked-Down Restricted Sites Zone. Its data corresponds to the Java URL policy values:

Java permissions

The 1C00 DWORD value selects the Java permission level for Java applets in the Locked-Down Intranet Zone of Internet Explorer or in compatible components that evaluate Internet Explorer security zones.

Java permissions

The 1C00 REG_DWORD value defines the permission level for Java applets in the Local Machine security zone. The Zones\0 key applies only to content that Windows maps to the Local Machine zone; it does not apply to the Local Intranet, Trusted Sites, Internet, or Restricted Sites zones.

Java permissions

This policy setting controls the permission level for Java applets in the Trusted Sites Zone. Zone number 2 identifies that zone, and the 1C00 DWORD value represents the URLACTION_JAVA_PERMISSIONS URL action.

Allow loading of XAML files

This registry value controls whether Internet Explorer loads XAML files from websites in the Internet zone. XAML is an XML-based markup language used, among other purposes, to define Windows Presentation Foundation user interfaces and graphics.

Allow loading of XAML files

The 2402 value controls whether Internet Explorer loads standalone XAML files for websites in the Restricted Sites zone. XAML is an XML-based declarative language used by Windows Presentation Foundation to describe user interfaces and graphics.

Include local path when user is uploading files to a server

This setting controls whether the local path of a selected file is sent to the server when the user uploads the file through an HTML form. It represents the Internet Explorer URL action URLACTION_HTML_INCLUDE_FILE_PATH for the Internet zone (Zone 3).

Internet Explorer Processes

These registry entries belong to the ADMX-backed Internet Explorer Processes policy under MK Protocol Security Restriction. When the restriction is enabled, Windows prevents File Explorer and Internet Explorer from using the MK protocol. Resources addressed through that protocol consequently fail to load in those processes.

Internet Explorer Processes

These registry entries belong to the ADMX-backed Internet Explorer Processes policy under MK Protocol Security Restriction. When the restriction is enabled, Windows prevents File Explorer and Internet Explorer from using the MK protocol. Resources addressed through that protocol consequently fail to load in those processes.

Allow updates to status bar via script

The 2103 registry value controls whether scripts from sites in the Restricted Sites Zone may change the text displayed in the Internet Explorer status bar. It represents the URLACTION_FEATURE_SCRIPT_STATUS_BAR URL action (0x00002103).

Initialize and script ActiveX controls not marked as safe

This policy controls whether ActiveX controls in the Local intranet zone can be initialized, loaded with parameters, and accessed by scripts when they are not marked as safe for untrusted data or scripting. The 1201 value represents the URL security action that governs overriding ActiveX object safety.

Initialize and script ActiveX controls not marked as safe

This security-zone policy controls whether ActiveX controls not marked as safe can be initialized, loaded with parameters, and accessed by scripts on pages in the Restricted Sites zone. The 1201 value is a REG_DWORD representing this specific zone action:

Security Zones: Use only machine settings

Security_HKLM_only is a machine-wide REG_DWORD value. When its value is 1, Windows obtains security-zone information exclusively from the machine settings under HKEY_LOCAL_MACHINE. Per-user zone settings stored under HKEY_CURRENT_USER are not used when the effective configuration is evaluated.

Turn on SmartScreen Filter scan

This policy controls whether SmartScreen Filter scans webpages assigned to the Internet zone for malicious content. The Zones\3 subkey identifies the Internet zone.

Use Pop-up Blocker

This policy controls Internet Explorer's Pop-up Blocker for websites in the Internet zone. Registry value 1809 is a REG_DWORD value.

Use Pop-up Blocker

The 1809 registry value controls Pop-up Blocker for websites in the Restricted Sites security zone (zone 4). It is a REG_DWORD value: 0 turns on Pop-up Blocker, while 3 turns it off.

Do not apply the Mark of the Web tag to files copied from insecure sources

This computer policy controls whether File Explorer tags files copied from locations that Windows classifies as insecure. The Mark of the Web (MotW) records security-zone information indicating that a file originated from an untrusted source.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the FEATURE_WINDOW_RESTRICTIONS feature for File Explorer and Internet Explorer processes. The feature constrains windows that scripts open, resize, or reposition programmatically.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the FEATURE_WINDOW_RESTRICTIONS feature for File Explorer and Internet Explorer processes. The feature constrains windows that scripts open, resize, or reposition programmatically.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the FEATURE_WINDOW_RESTRICTIONS feature for File Explorer and Internet Explorer processes. The feature constrains windows that scripts open, resize, or reposition programmatically.

Launching applications and files in an IFRAME

The 1804 REG_DWORD value controls whether applications may be launched and files downloaded when a page assigned to the Restricted Sites zone (zone 4) initiates the operation through an IFRAME reference in its HTML.

Launching applications and files in an IFRAME

This policy setting controls whether applications may be launched and files may be downloaded when referenced by an HTML IFRAME on a page in the Internet zone. Zone identifier 3 represents the Internet zone, while value name 1804 corresponds to the URLACTION_SHELL_VERB URL action.

Turn off the Security Settings Check feature

This ADMX-backed policy setting disables the Internet Explorer feature that evaluates the browser’s security settings to determine whether they expose Internet Explorer to risk.

Allow fallback to SSL 3.0 (Internet Explorer)

This machine-wide registry value controls whether Internet Explorer may retry a connection with SSL 3.0 or an older enabled protocol after an attempt using TLS 1.0 or later fails.

Internet Explorer Processes

This ADMX-backed policy controls protection from zone elevation for Internet Explorer components running in explorer.exe and iexplore.exe. Internet Explorer assigns content to security zones such as the Internet, Local intranet, and Local Machine zones. Each zone imposes a different set of security restrictions.

Internet Explorer Processes

This ADMX-backed policy controls protection from zone elevation for Internet Explorer components running in explorer.exe and iexplore.exe. Internet Explorer assigns content to security zones such as the Internet, Local intranet, and Local Machine zones. Each zone imposes a different set of security restrictions.

Process List

This Group Policy setting determines, for individual executable files, whether the Internet Explorer Protection From Zone Elevation feature applies. The feature prevents navigation that was not initiated by the user from a page in one security zone to a more privileged, less restricted zone.

Allow scriptlets

This ADMX-backed policy controls whether scriptlets may run in the Internet Explorer Restricted Sites security zone. Zone number 4 refers specifically to that zone.

Check for signatures on downloaded programs

This Internet Explorer policy controls whether digital signatures on executable programs are checked before download. A valid digital signature can identify the software publisher and indicate whether the signed file has been altered after signing.

Run .NET Framework-reliant components signed with Authenticode

This registry value controls the URLACTION_MANAGED_SIGNED URL action for the Internet Explorer Internet zone. It determines whether Authenticode-signed managed .NET Framework components may run. The affected components include managed controls referenced by an object element and managed executables referenced by a link.

Run .NET Framework-reliant components signed with Authenticode

This registry value controls whether Internet Explorer may execute Authenticode-signed, managed .NET Framework components originating from websites in the Restricted Sites zone. These components include managed controls referenced by an HTML object tag and managed executables referenced by a link.

Allow scripting of Internet Explorer WebBrowser controls

This policy determines whether pages in the Restricted Sites zone may control embedded Internet Explorer WebBrowser controls through script.

Allow active scripting

This policy setting determines whether script code may run on pages assigned to the Internet Explorer Restricted Sites security zone. The 1400 value represents the URLACTION_SCRIPT_RUN URL action.

Scripting of Java applets

This setting controls whether scripts on pages in the Restricted Sites zone can access the properties, methods, and events that Java applets expose to scripting. It governs interaction between scripts and applets; it does not determine whether Java applets are allowed to run.

Prevent managing SmartScreen Filter

EnabledV9 is a REG_DWORD policy value for Internet Explorer's SmartScreen Filter. It enforces the filter mode and prevents users from changing that mode in Internet Explorer.

Turn on SmartScreen Filter scan

This policy controls whether SmartScreen Filter scans webpages in the Locked-Down Restricted Sites Zone for malicious content. Registry value 2301 represents the Internet Explorer URL action URLACTION_ALLOW_APEVALUATION.

Turn on SmartScreen Filter scan

This setting controls whether SmartScreen Filter scans webpages in the Locked-Down Internet Zone for malicious content. It is part of the Internet Explorer security-zone model.

Turn on SmartScreen Filter scan

This Internet Explorer policy controls whether SmartScreen Filter scans webpages assigned to the Restricted Sites zone. The zone is identified by key number 4, while value 2301 holds its zone-specific SmartScreen setting.

Allow software to run or install even if the signature is invalid

This Internet Explorer policy controls whether users can install or run software whose digital signature is invalid. Its scope includes software such as ActiveX controls and files downloaded through Internet Explorer.

Show security warning for potentially unsafe files

The 1806 DWORD value governs the URLACTION_SHELL_EXECUTE_HIGHRISK URL security action for the Restricted Sites zone. It determines whether Windows may open executable files and other files classified as potentially unsafe without interruption, must display the “Open File – Security Warning” prompt first, or must block the operation.

Disable Internet Explorer 11 Launch Via COM Automation

A DWORD value of 1 prevents Internet Explorer 11 from being launched through COM automation. Applications and scripts can no longer create a new Internet Explorer instance through its automation interfaces.

Allow updates to status bar via script

This registry value determines whether scripts on pages in the Internet zone may change the text displayed in the Internet Explorer status bar. The value name 2103 identifies the URLACTION_FEATURE_SCRIPT_STATUS_BAR URL action, whose numeric identifier is 0x00002103.

Allow only approved domains to use ActiveX controls without prompt

This ADMX-backed policy controls per-domain approval for installed ActiveX controls in the Internet zone. It applies when a website attempts to use an ActiveX control that was installed by a different website.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature for Windows Explorer and Internet Explorer processes. The feature applies to file downloads that were not explicitly initiated by a user action such as a mouse click or key press.

Internet Explorer Processes

This ADMX-backed Group Policy setting controls the Internet Explorer FEATURE_RESTRICT_FILEDOWNLOAD security feature for Windows Explorer and Internet Explorer processes. The feature applies to file downloads that were not explicitly initiated by a user action such as a mouse click or key press.

Initialize and script ActiveX controls not marked as safe

Registry value 1201 determines whether content in the Internet zone may initialize and script ActiveX controls whose developers have not marked them as safe for initialization with untrusted data or safe for scripting.

Initialize and script ActiveX controls not marked as safe

This ADMX-backed Group Policy setting controls whether ActiveX controls in the Trusted Sites zone may be initialized, loaded with parameters, and accessed by scripts when they are not marked as safe for untrusted data or scripting.

Run .NET Framework-reliant components not signed with Authenticode

This zone-specific registry value represents the URLACTION_MANAGED_UNSIGNED (0x00002004) URL security action for the Internet zone (Zones\3). It determines whether Internet Explorer may execute managed, .NET Framework-reliant components that are not signed with Authenticode. These components include managed controls referenced by an object element and managed executables referenced by a link.

Run .NET Framework-reliant components not signed with Authenticode

The 2004 registry value controls the URLACTION_MANAGED_UNSIGNED (0x00002004) URL security action for Internet Explorer's Restricted Sites zone. It determines whether unsigned managed components that depend on the .NET Framework may run. The affected content includes managed controls referenced by an object element and managed executables referenced by a link.

Allow VBScript to run in Internet Explorer

The 140C registry value controls whether pages in the Internet zone may execute VBScript within Internet Explorer or its underlying MSHTML engine. It is a REG_DWORD value using the standard Internet Explorer URL-action policy values:

Allow VBScript to run in Internet Explorer

The 140C value controls whether Internet Explorer may run VBScript on pages in the Restricted Sites Zone. The value under HKLM represents the device policy, while the value under HKCU represents the user policy.

Allow only approved domains to use the TDC ActiveX control

The 120c REG_DWORD value controls whether websites in the Internet zone may run the Tabular Data Control (TDC). This legacy ActiveX control enables HTML pages to load, display, and filter data from delimited text files.

Show security warning for potentially unsafe files

The 1806 REG_DWORD value controls the URL security action for opening executable files and other files classified as potentially unsafe when they originate from the Internet zone. Zone number 3 represents the Internet zone.

Turn on certificate address mismatch warning

This Internet Explorer policy enforces a security warning when an HTTPS website presents a certificate whose identity does not match the website address being visited. This includes cases in which the requested host name is not covered by the certificate name or a subject alternative name.

Turn on Cross-Site Scripting Filter

This setting controls the Internet Explorer engine's Cross-Site Scripting (XSS) Filter for websites in the Restricted Sites zone. The 4 in the registry path identifies that security zone, while the value name 1409 represents the URLACTION_SCRIPT_XSSFILTER URL action (0x00001409).

Turn on Cross-Site Scripting Filter

The 1409 registry value controls the Internet Explorer Cross-Site Scripting (XSS) Filter for websites in the Internet Zone. The filter examines cross-site script injections and attempts to block content that it identifies as an XSS attack.

Check for server certificate revocation

This policy controls whether Internet Explorer checks the revocation status of server certificates. A certification authority can revoke a certificate when, for example, its private key has been compromised or the certificate should no longer be accepted.

Enable dragging of content from different domains within a window

This value controls whether Internet Explorer permits users to drag content from one domain to another when the source and destination are in the same browser window. It applies specifically to content evaluated in the Internet zone.

Enable dragging of content from different domains across windows

The 2709 REG_DWORD value controls whether content can be dragged between different domains when the source and destination are in separate windows. It applies to the Internet zone.

Web sites in less privileged Web content zones can navigate into this zone

The 2101 value controls the URLACTION_FEATURE_ZONE_ELEVATION URL action for the Internet zone, represented by zone key 3. It determines whether a site in a less privileged zone, such as the Restricted Sites zone, may open a new window in or initiate navigation into the Internet zone.

Web sites in less privileged Web content zones can navigate into this zone

This ADMX-backed Internet Explorer policy controls protection from zone elevation for navigations into the Restricted Sites zone. The value name 2101 identifies the URLACTION_FEATURE_ZONE_ELEVATION URL action (0x00002101).

Allow cut, copy or paste operations from the clipboard via script

This policy controls whether scripts in webpages assigned to the Internet zone may perform clipboard operations such as cut, copy, or paste. The 3 in the registry path identifies the Internet zone.

Allow cut, copy or paste operations from the clipboard via script

The 1407 registry value controls whether scripts in the Internet Explorer Restricted Sites security zone can perform clipboard operations such as cut, copy, or paste. It represents the URLACTION_SCRIPT_PASTE URL security action.

Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled

This policy prevents Internet Explorer from falling back from Enhanced Protected Mode to regular Protected Mode so that an incompatible ActiveX control can run.

Turn off encryption support

This policy setting determines which SSL and TLS protocol versions Internet Explorer and applications that obtain their connection settings from WinINet may use. SecureProtocols is a REG_DWORD bitmask representing the permitted protocols from SSL 2.0, SSL 3.0, TLS 1.0, TLS 1.1, and TLS 1.2.

Turn on the auto-complete feature for user names and passwords on forms

This user-scoped, ADMX-backed policy controls the Internet Explorer AutoComplete feature for user names and passwords in web forms. The feature can retain credentials entered by the user and suggest them again on subsequent visits.

Turn on the auto-complete feature for user names and passwords on forms

This user-scoped, ADMX-backed policy controls the Internet Explorer AutoComplete feature for user names and passwords in web forms. The feature can retain credentials entered by the user and suggest them again on subsequent visits.

Turn on the auto-complete feature for user names and passwords on forms

This user-scoped, ADMX-backed policy controls the Internet Explorer AutoComplete feature for user names and passwords in web forms. The feature can retain credentials entered by the user and suggest them again on subsequent visits.

See also