mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-12 05:17:22 +00:00

Alekhya Jupudi 8af95e7302 Checking Acrolinx score for this file

2021-09-29 13:31:15 +05:30

516 KiB

Raw Blame History

title, description, ms.author, ms.topic, ms.prod, ms.technology, author, ms.localizationpriority, ms.reviewer, manager

title	description	ms.author	ms.topic	ms.prod	ms.technology	author	ms.localizationpriority	ms.reviewer	manager
Policy CSP - InternetExplorer	Use the Policy CSP - InternetExplorer setting to add a specific list of search providers to the user's default list of search providers.	dansimp	article	w10	windows	dansimp	medium		dansimp

Policy CSP - InternetExplorer

InternetExplorer policies

InternetExplorer/AddSearchProvider

InternetExplorer/AllowActiveXFiltering

InternetExplorer/AllowAddOnList

InternetExplorer/AllowAutoComplete

InternetExplorer/AllowCertificateAddressMismatchWarning

InternetExplorer/AllowDeletingBrowsingHistoryOnExit

InternetExplorer/AllowEnhancedProtectedMode

InternetExplorer/AllowEnhancedSuggestionsInAddressBar

InternetExplorer/AllowEnterpriseModeFromToolsMenu

InternetExplorer/AllowEnterpriseModeSiteList

InternetExplorer/AllowFallbackToSSL3

InternetExplorer/AllowInternetExplorer7PolicyList

InternetExplorer/AllowInternetExplorerStandardsMode

InternetExplorer/AllowInternetZoneTemplate

InternetExplorer/AllowIntranetZoneTemplate

InternetExplorer/AllowLocalMachineZoneTemplate

InternetExplorer/AllowLockedDownInternetZoneTemplate

InternetExplorer/AllowLockedDownIntranetZoneTemplate

InternetExplorer/AllowLockedDownLocalMachineZoneTemplate

InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate

InternetExplorer/AllowOneWordEntry

InternetExplorer/AllowSaveTargetAsInIEMode

InternetExplorer/AllowSiteToZoneAssignmentList

InternetExplorer/AllowSoftwareWhenSignatureIsInvalid

InternetExplorer/AllowSuggestedSites

InternetExplorer/AllowTrustedSitesZoneTemplate

InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate

InternetExplorer/AllowsRestrictedSitesZoneTemplate

InternetExplorer/CheckServerCertificateRevocation

InternetExplorer/CheckSignaturesOnDownloadedPrograms

InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses

InternetExplorer/ConfigureEdgeRedirectChannel

InternetExplorer/DisableActiveXVersionListAutoDownload

InternetExplorer/DisableAdobeFlash

InternetExplorer/DisableBypassOfSmartScreenWarnings

InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles

InternetExplorer/DisableCompatView

InternetExplorer/DisableConfiguringHistory

InternetExplorer/DisableCrashDetection

InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation

InternetExplorer/DisableDeletingUserVisitedWebsites

InternetExplorer/DisableEnclosureDownloading

InternetExplorer/DisableEncryptionSupport

InternetExplorer/DisableFeedsBackgroundSync

InternetExplorer/DisableFirstRunWizard

InternetExplorer/DisableFlipAheadFeature

InternetExplorer/DisableGeolocation

InternetExplorer/DisableHomePageChange

InternetExplorer/DisableInternetExplorerApp

InternetExplorer/DisableIgnoringCertificateErrors

InternetExplorer/DisableInPrivateBrowsing

InternetExplorer/DisableProcessesInEnhancedProtectedMode

InternetExplorer/DisableProxyChange

InternetExplorer/DisableSearchProviderChange

InternetExplorer/DisableSecondaryHomePageChange

InternetExplorer/DisableSecuritySettingsCheck

InternetExplorer/DisableUpdateCheck

InternetExplorer/DisableWebAddressAutoComplete

InternetExplorer/DoNotAllowActiveXControlsInProtectedMode

InternetExplorer/DoNotAllowUsersToAddSites

InternetExplorer/DoNotAllowUsersToChangePolicies

InternetExplorer/DoNotBlockOutdatedActiveXControls

InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains

InternetExplorer/IncludeAllLocalSites

InternetExplorer/IncludeAllNetworkPaths

InternetExplorer/InternetZoneAllowAccessToDataSources

InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/InternetZoneAllowCopyPasteViaScript

InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles

InternetExplorer/InternetZoneAllowFontDownloads

InternetExplorer/InternetZoneAllowLessPrivilegedSites

InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles

InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents

InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls

InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl

InternetExplorer/InternetZoneAllowScriptInitiatedWindows

InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls

InternetExplorer/InternetZoneAllowScriptlets

InternetExplorer/InternetZoneAllowSmartScreenIE

InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript

InternetExplorer/InternetZoneAllowUserDataPersistence

InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer

InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls

InternetExplorer/InternetZoneDownloadSignedActiveXControls

InternetExplorer/InternetZoneDownloadUnsignedActiveXControls

InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter

InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows

InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows

InternetExplorer/InternetZoneEnableMIMESniffing

InternetExplorer/InternetZoneEnableProtectedMode

InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer

InternetExplorer/InternetZoneInitializeAndScriptActiveXControls

InternetExplorer/InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe

InternetExplorer/InternetZoneJavaPermissions

InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME

InternetExplorer/InternetZoneLogonOptions

InternetExplorer/InternetZoneNavigateWindowsAndFrames

InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode

InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles

InternetExplorer/InternetZoneUsePopupBlocker

InternetExplorer/IntranetZoneAllowAccessToDataSources

InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/IntranetZoneAllowFontDownloads

InternetExplorer/IntranetZoneAllowLessPrivilegedSites

InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents

InternetExplorer/IntranetZoneAllowScriptlets

InternetExplorer/IntranetZoneAllowSmartScreenIE

InternetExplorer/IntranetZoneAllowUserDataPersistence

InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls

InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls

InternetExplorer/IntranetZoneJavaPermissions

InternetExplorer/IntranetZoneNavigateWindowsAndFrames

InternetExplorer/KeepIntranetSitesInInternetExplorer

InternetExplorer/LocalMachineZoneAllowAccessToDataSources

InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/LocalMachineZoneAllowFontDownloads

InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites

InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents

InternetExplorer/LocalMachineZoneAllowScriptlets

InternetExplorer/LocalMachineZoneAllowSmartScreenIE

InternetExplorer/LocalMachineZoneAllowUserDataPersistence

InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls

InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls

InternetExplorer/LocalMachineZoneJavaPermissions

InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames

InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources

InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/LockedDownInternetZoneAllowFontDownloads

InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites

InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents

InternetExplorer/LockedDownInternetZoneAllowScriptlets

InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE

InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence

InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls

InternetExplorer/LockedDownInternetZoneJavaPermissions

InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames

InternetExplorer/LockedDownIntranetJavaPermissions

InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources

InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/LockedDownIntranetZoneAllowFontDownloads

InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites

InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents

InternetExplorer/LockedDownIntranetZoneAllowScriptlets

InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE

InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence

InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls

InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames

InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources

InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads

InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites

InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents

InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets

InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE

InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence

InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls

InternetExplorer/LockedDownLocalMachineZoneJavaPermissions

InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames

InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources

InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads

InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites

InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents

InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets

InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE

InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence

InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls

InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions

InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames

InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources

InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads

InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites

InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents

InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets

InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE

InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence

InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls

InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions

InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames

InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses

InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses

InternetExplorer/NewTabDefaultPage

InternetExplorer/NotificationBarInternetExplorerProcesses

InternetExplorer/PreventManagingSmartScreenFilter

InternetExplorer/PreventPerUserInstallationOfActiveXControls

InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses

InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls

InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses

InternetExplorer/RestrictFileDownloadInternetExplorerProcesses

InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources

InternetExplorer/RestrictedSitesZoneAllowActiveScripting

InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors

InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript

InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles

InternetExplorer/RestrictedSitesZoneAllowFileDownloads

InternetExplorer/RestrictedSitesZoneAllowFontDownloads

InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites

InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles

InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH

InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents

InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls

InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl

InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows

InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls

InternetExplorer/RestrictedSitesZoneAllowScriptlets

InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE

InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript

InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence

InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer

InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls

InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls

InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls

InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter

InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows

InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows

InternetExplorer/RestrictedSitesZoneEnableMIMESniffing

InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer

InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls

InternetExplorer/RestrictedSitesZoneJavaPermissions

InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME

InternetExplorer/RestrictedSitesZoneLogonOptions

InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames

InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins

InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode

InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting

InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets

InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles

InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode

InternetExplorer/RestrictedSitesZoneUsePopupBlocker

InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses

InternetExplorer/SearchProviderList

InternetExplorer/SecurityZonesUseOnlyMachineSettings

InternetExplorer/SendSitesNotInEnterpriseSiteListToEdge

InternetExplorer/SpecifyUseOfActiveXInstallerService

InternetExplorer/TrustedSitesZoneAllowAccessToDataSources

InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls

InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads

InternetExplorer/TrustedSitesZoneAllowFontDownloads

InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites

InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents

InternetExplorer/TrustedSitesZoneAllowScriptlets

InternetExplorer/TrustedSitesZoneAllowSmartScreenIE

InternetExplorer/TrustedSitesZoneAllowUserDataPersistence

InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls

InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls

InternetExplorer/TrustedSitesZoneJavaPermissions

InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames

InternetExplorer/AddSearchProvider

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to add a specific list of search providers to the user's default list of search providers. Normally, search providers can be added from third-party toolbars or in Setup. The user can also add a search provider from the provider's website.

If you enable this policy setting, the user can add and remove search providers, but only from the set of search providers specified in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Note: This list can be created from a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.

If you disable or do not configure this policy setting, the user can configure their list of search providers unless another policy setting restricts such configuration.

ADMX Info:

GP Friendly name: Add a specific list of search providers to the user's list of search providers
GP name: AddSearchProvider
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/AllowActiveXFiltering

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls the ActiveX Filtering feature for websites that are running ActiveX controls. The user can choose to turn off ActiveX Filtering for specific websites so that ActiveX controls can run properly.

If you enable this policy setting, ActiveX Filtering is enabled by default for the user. The user cannot turn off ActiveX Filtering, although they may add per-site exceptions.

If you disable or do not configure this policy setting, ActiveX Filtering is not enabled by default for the user. The user can turn ActiveX Filtering on or off.

ADMX Info:

GP Friendly name: Turn on ActiveX Filtering
GP name: TurnOnActiveXFiltering
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/AllowAddOnList

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer. Add-ons in this case are controls like ActiveX Controls, Toolbars, and Browser Helper Objects (BHOs) which are specifically written to extend or enhance the functionality of the browser or web pages.

This list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.

If you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:

Name of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, ‘{000000000-0000-0000-0000-0000000000000}'. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.

Value - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.

If you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied.

ADMX Info:

GP Friendly name: Add-on List
GP name: AddonManagement_AddOnList
GP path: Windows Components/Internet Explorer/Security Features/Add-on Management
GP ADMX file name: inetres.admx

InternetExplorer/AllowAutoComplete

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This AutoComplete feature can remember and suggest User names and passwords on Forms.

If you enable this setting, the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms will be turned on. You have to decide whether to select "prompt me to save passwords".

If you disable this setting the user cannot change "User name and passwords on forms" or "prompt me to save passwords". The Auto Complete feature for User names and passwords on Forms is turned off. The user also cannot opt to be prompted to save passwords.

If you do not configure this setting, the user has the freedom of turning on Auto complete for User name and passwords on forms and the option of prompting to save passwords. To display this option, the users open the Internet Options dialog box, click the Contents Tab and click the Settings button.

ADMX Info:

GP Friendly name: Turn on the auto-complete feature for user names and passwords on forms
GP name: RestrictFormSuggestPW
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/AllowCertificateAddressMismatchWarning

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to turn on the certificate address mismatch security warning. When this policy setting is turned on, the user is warned when visiting Secure HTTP (HTTPS) websites that present certificates issued for a different website address. This warning helps prevent spoofing attacks.

If you enable this policy setting, the certificate address mismatch warning always appears.

If you disable or do not configure this policy setting, the user can choose whether the certificate address mismatch warning appears (by using the Advanced page in the Internet Control panel).

ADMX Info:

GP Friendly name: Turn on certificate address mismatch warning
GP name: IZ_PolicyWarnCertMismatch
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowDeletingBrowsingHistoryOnExit

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows the automatic deletion of specified items when the last browser window closes. The preferences selected in the Delete Browsing History dialog box (such as deleting temporary Internet files, cookies, history, form data, and passwords) are applied, and those items are deleted.

If you enable this policy setting, deleting browsing history on exit is turned on.

If you disable this policy setting, deleting browsing history on exit is turned off.

If you do not configure this policy setting, it can be configured on the General tab in Internet Options.

If the "Prevent access to Delete Browsing History" policy setting is enabled, this policy setting has no effect.

ADMX Info:

GP Friendly name: Allow deleting browsing history on exit
GP name: DBHDisableDeleteOnExit
GP path: Windows Components/Internet Explorer/Delete Browsing History
GP ADMX file name: inetres.admx

InternetExplorer/AllowEnhancedProtectedMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Enhanced Protected Mode provides additional protection against malicious websites by using 64-bit processes on 64-bit versions of Windows. For computers running at least Windows 8, Enhanced Protected Mode also limits the locations Internet Explorer can read from in the registry and the file system.

If you enable this policy setting, Enhanced Protected Mode will be turned on. Any zone that has Protected Mode enabled will use Enhanced Protected Mode. Users will not be able to disable Enhanced Protected Mode.

If you disable this policy setting, Enhanced Protected Mode will be turned off. Any zone that has Protected Mode enabled will use the version of Protected Mode introduced in Internet Explorer 7 for Windows Vista.

If you do not configure this policy, users will be able to turn on or turn off Enhanced Protected Mode on the Advanced tab of the Internet Options dialog.

ADMX Info:

GP Friendly name: Turn on Enhanced Protected Mode
GP name: Advanced_EnableEnhancedProtectedMode
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowEnhancedSuggestionsInAddressBar

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows Internet Explorer to provide enhanced suggestions as the user types in the Address bar. To provide enhanced suggestions, the user's keystrokes are sent to Microsoft through Microsoft services.

If you enable this policy setting, users receive enhanced suggestions while typing in the Address bar. In addition, users cannot change the Suggestions setting on the Settings charm.

If you disable this policy setting, users do not receive enhanced suggestions while typing in the Address bar. In addition, users cannot change the Suggestions setting on the Settings charm.

If you do not configure this policy setting, users can change the Suggestions setting on the Settings charm.

ADMX Info:

GP Friendly name: Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar
GP name: AllowServicePoweredQSA
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

Supported values:

0 - Disabled
1 - Enabled (Default)

InternetExplorer/AllowEnterpriseModeFromToolsMenu

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting lets you decide whether users can turn on Enterprise Mode for websites with compatibility issues. Optionally, this policy also lets you specify where to get reports (through post messages) about the websites for which users turn on Enterprise Mode using the Tools menu.

If you turn this setting on, users can see and use the Enterprise Mode option from the Tools menu. If you turn this setting on, but don't specify a report location, Enterprise Mode will still be available to your users, but you won't get any reports.

If you disable or don't configure this policy setting, the menu option won't appear and users won't be able to run websites in Enterprise Mode.

ADMX Info:

GP Friendly name: Let users turn on and use Enterprise Mode from the Tools menu
GP name: EnterpriseModeEnable
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/AllowEnterpriseModeSiteList

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting lets you specify where to find the list of websites you want opened using Enterprise Mode IE, instead of Standard mode, because of compatibility issues. Users can't edit this list.

If you enable this policy setting, Internet Explorer downloads the website list from your location (HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\Main\EnterpriseMode), opening all listed websites using Enterprise Mode IE.

If you disable or don't configure this policy setting, Internet Explorer opens all websites using Standards mode.

ADMX Info:

GP Friendly name: Use the Enterprise Mode IE website list
GP name: EnterpriseModeSiteList
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/AllowFallbackToSSL3

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to block an insecure fallback to SSL 3.0. When this policy is enabled, Internet Explorer will attempt to connect to sites using SSL 3.0 or below when TLS 1.0 or greater fails.

We recommend that you do not allow insecure fallback in order to prevent a man-in-the-middle attack.

This policy does not affect which security protocols are enabled.

If you disable this policy, system defaults will be used.

ADMX Info:

GP Friendly name: Allow fallback to SSL 3.0 (Internet Explorer)
GP name: Advanced_EnableSSL3Fallback
GP path: Windows Components/Internet Explorer/Security Features
GP ADMX file name: inetres.admx

InternetExplorer/AllowInternetExplorer7PolicyList

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to add specific sites that must be viewed in Internet Explorer 7 Compatibility View.

If you enable this policy setting, the user can add and remove sites from the list, but the user cannot remove the entries that you specify.

If you disable or do not configure this policy setting, the user can add and remove sites from the list.

ADMX Info:

GP Friendly name: Use Policy List of Internet Explorer 7 sites
GP name: CompatView_UsePolicyList
GP path: Windows Components/Internet Explorer/Compatibility View
GP ADMX file name: inetres.admx

InternetExplorer/AllowInternetExplorerStandardsMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls how Internet Explorer displays local intranet content. Intranet content is defined as any webpage that belongs to the local intranet security zone.

If you enable this policy setting, Internet Explorer uses the current user agent string for local intranet content. Additionally, all local intranet Standards Mode pages appear in the Standards Mode available with the latest version of Internet Explorer. The user cannot change this behavior through the Compatibility View Settings dialog box.

If you disable this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. The user cannot change this behavior through the Compatibility View Settings dialog box.

If you do not configure this policy setting, Internet Explorer uses an Internet Explorer 7 user agent string (with an additional string appended) for local intranet content. Additionally, all local intranet Standards Mode pages appear in Internet Explorer 7 Standards Mode. This option results in the greatest compatibility with existing webpages, but newer content written to common Internet standards may be displayed incorrectly. This option matches the default behavior of Internet Explorer.

ADMX Info:

GP Friendly name: Turn on Internet Explorer Standards Mode for local intranet
GP name: CompatView_IntranetSites
GP path: Windows Components/Internet Explorer/Compatibility View
GP ADMX file name: inetres.admx

InternetExplorer/AllowInternetZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADMX Info:

GP Friendly name: Internet Zone Template
GP name: IZ_PolicyInternetZoneTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowIntranetZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Intranet Zone Template
GP name: IZ_PolicyIntranetZoneTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowLocalMachineZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Local Machine Zone Template
GP name: IZ_PolicyLocalMachineZoneTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowLockedDownInternetZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Locked-Down Internet Zone Template
GP name: IZ_PolicyInternetZoneLockdownTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowLockedDownIntranetZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Locked-Down Intranet Zone Template
GP name: IZ_PolicyIntranetZoneLockdownTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowLockedDownLocalMachineZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Locked-Down Local Machine Zone Template
GP name: IZ_PolicyLocalMachineZoneLockdownTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowLockedDownRestrictedSitesZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Locked-Down Restricted Sites Zone Template
GP name: IZ_PolicyRestrictedSitesZoneLockdownTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowOneWordEntry

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy allows the user to go directly to an intranet site for a one-word entry in the Address bar.

If you enable this policy setting, Internet Explorer goes directly to an intranet site for a one-word entry in the Address bar, if it is available.

If you disable or do not configure this policy setting, Internet Explorer does not go directly to an intranet site for a one-word entry in the Address bar.

ADMX Info:

GP Friendly name: Go to an intranet site for a one-word entry in the Address bar
GP name: UseIntranetSiteForOneWordEntry
GP path: Windows Components/Internet Explorer/Internet Settings/Advanced settings/Browsing
GP ADMX file name: inetres.admx

InternetExplorer/AllowSaveTargetAsInIEMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows the administrator to enable "Save Target As" context menu in Internet Explorer mode.

If you enable this policy, "Save Target As" will show up in the Internet Explorer mode context menu and work the same as Internet Explorer.
If you disable or do not configure this policy setting, "Save Target As" will not show up in the Internet Explorer mode context menu.

For more information, see https://go.microsoft.com/fwlink/?linkid=2102115

ADMX Info:

GP Friendly name: Allow "Save Target As" in Internet Explorer mode
GP name: AllowSaveTargetAsInIEMode
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

 <policy name="AllowSaveTargetAsInIEMode" class="Both" displayName="$(string.AllowSaveTargetAsInIEMode)" explainText="$(string.IE_ExplainAllowSaveTargetAsInIEMode)" key="Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode" valueName="AllowSaveTargetAsInIEMode">
      <parentCategory ref="InternetExplorer" />
      <supportedOn ref="SUPPORTED_IE11" />
      <enabledValue>
        <decimal value="1" />
      </enabledValue>
      <disabledValue>
        <decimal value="0" />
      </disabledValue>
    </policy>

InternetExplorer/AllowSiteToZoneAssignmentList

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.

Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)

If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:

Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.

Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.

If you disable or do not configure this policy, users may choose their own site-to-zone assignments.

The list is a set of pairs of strings. Each string is separated by F000. Each pair of strings is stored as a registry name and value. The registry name is the site and the value is an index. The index has to be sequential. See an example below.

ADMX Info:

GP Friendly name: Site to Zone Assignment List
GP name: IZ_Zonemaps
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

  <SyncBody>
      <Replace>
          <CmdID>2</CmdID>
           <Item>
               <Meta>
                  <Format>chr</Format>
                  <Type>text/plain</Type>
              </Meta>
              <Target>
                  <LocURI>./Device/Vendor/MSFT/Policy/Config/InternetExplorer/AllowSiteToZoneAssignmentList</LocURI>
              </Target>
               <Data>&lt;Enabled/&gt;&lt;Data id=&quot;IZ_ZonemapPrompt&quot; value=&quot;http://adfs.contoso.org&#xF000;1&#xF000;http://microsoft.com&#xF000;2&quot;/&gt;</Data>
          </Item>
      </Replace>
      <Final/>
  </SyncBody>

Value and index pairs in the SyncML example:

InternetExplorer/AllowSoftwareWhenSignatureIsInvalid

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file.

If you enable this policy setting, users will be prompted to install or run files with an invalid signature.

If you disable this policy setting, users cannot run or install files with an invalid signature.

If you do not configure this policy, users can choose to run or install files with an invalid signature.

ADMX Info:

GP Friendly name: Allow software to run or install even if the signature is invalid
GP name: Advanced_InvalidSignatureBlock
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowSuggestedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls the Suggested Sites feature, which recommends websites based on the user’s browsing activity. Suggested Sites reports a user’s browsing history to Microsoft to suggest sites that the user might want to visit.

If you enable this policy setting, the user is not prompted to enable Suggested Sites. The user’s browsing history is sent to Microsoft to produce suggestions.

If you disable this policy setting, the entry points and functionality associated with this feature are turned off.

If you do not configure this policy setting, the user can turn on and turn off the Suggested Sites feature.

ADMX Info:

GP Friendly name: Turn on Suggested Sites
GP name: EnableSuggestedSites
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/AllowTrustedSitesZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Trusted Sites Zone Template
GP name: IZ_PolicyTrustedSitesZoneTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowsLockedDownTrustedSitesZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Locked-Down Trusted Sites Zone Template
GP name: IZ_PolicyTrustedSitesZoneLockdownTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/AllowsRestrictedSitesZoneTemplate

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

ADMX Info:

GP Friendly name: Restricted Sites Zone Template
GP name: IZ_PolicyRestrictedSitesZoneTemplate
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/CheckServerCertificateRevocation

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.

If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.

If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

ADMX Info:

GP Friendly name: Check for server certificate revocation
GP name: Advanced_CertificateRevocation
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/CheckSignaturesOnDownloadedPrograms

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.

If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.

If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

ADMX Info:

GP Friendly name: Check for signatures on downloaded programs
GP name: Advanced_DownloadSignatures
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/ConfigureEdgeRedirectChannel

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Enables you to configure up to three versions of Microsoft Edge to open a redirected site (in order of preference). Use this policy, if your environment is configured to redirect sites from Internet Explorer 11 to Microsoft Edge. If any of the chosen versions are not installed on the device, that preference will be bypassed.

If both the Windows Update for the next version of Microsoft Edge* and Microsoft Edge Stable channel are installed, the following behaviors occur:

If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: 1 = Microsoft Edge Stable 2 = Microsoft Edge Beta version 77 or later 3 = Microsoft Edge Dev version 77 or later 4 = Microsoft Edge Canary version 77 or later
If you disable or do not configure this policy, Microsoft Edge Stable channel is used. This is the default behavior.

If the Windows Update for the next version of Microsoft Edge* or Microsoft Edge Stable channel are not installed, the following behaviors occur:

If you enable this policy, you can configure redirected sites to open in up to three of the following channels where: 0 = Microsoft Edge version 45 or earlier 1 = Microsoft Edge Stable 2 = Microsoft Edge Beta version 77 or later 3 = Microsoft Edge Dev version 77 or later 4 = Microsoft Edge Canary version 77 or later
If you disable or do not configure this policy, Microsoft Edge version 45 or earlier is automatically used. This is the default behavior.

ADMX Info:

GP Friendly name: Configure which channel of Microsoft Edge to use for opening redirected sites
GP name: NeedEdgeBrowser
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

 <policy name="NeedEdgeBrowser" class="Both" displayName="$(string.NeedEdgeBrowser)" explainText="$(string.IE_ExplainNeedEdgeBrowser)" key="Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode" presentation="$(presentation.NeedEdgeBrowser)">

      <parentCategory ref="InternetExplorer" />

      <supportedOn ref="SUPPORTED_IE11" />

      <elements>

        <enum id="NeedEdgeBrowser" valueName="NeedEdgeBrowser">

          <item displayName="$(string.NeedEdgeBrowserChoice_None)">

            <value>

              <delete />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumStable)">

            <value>

              <decimal value="1" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumBeta)">

            <value>

              <decimal value="2" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumDev)">

            <value>

              <decimal value="3" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumCanary)">

            <value>

              <decimal value="4" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_EdgeHTML)">

            <value>

              <decimal value="0" />

            </value>

          </item>

        </enum>

        <enum id="NeedEdgeBrowser2" valueName="NeedEdgeBrowser2">

          <item displayName="$(string.NeedEdgeBrowserChoice_None)">

            <value>

              <delete />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumStable)">

            <value>

              <decimal value="1" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumBeta)">

            <value>

              <decimal value="2" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumDev)">

            <value>

              <decimal value="3" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumCanary)">

            <value>

              <decimal value="4" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_EdgeHTML)">

            <value>

              <decimal value="0" />

            </value>

          </item>

        </enum>

        <enum id="NeedEdgeBrowser3" valueName="NeedEdgeBrowser3">

          <item displayName="$(string.NeedEdgeBrowserChoice_None)">

            <value>

              <delete />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumStable)">

            <value>

              <decimal value="1" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumBeta)">

            <value>

              <decimal value="2" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumDev)">

            <value>

              <decimal value="3" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_ChromiumCanary)">

            <value>

              <decimal value="4" />

            </value>

          </item>

          <item displayName="$(string.NeedEdgeBrowserChoice_EdgeHTML)">

            <value>

              <decimal value="0" />

            </value>

          </item>

        </enum>

      </elements>

    </policy>

InternetExplorer/ConsistentMimeHandlingInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) data to determine file handling procedures for files received through a Web server.

This policy setting determines whether Internet Explorer requires that all file-type information provided by Web servers be consistent. For example, if the MIME type of a file is text/plain but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving it in the Internet Explorer cache and changing its extension.

If you enable this policy setting, Internet Explorer requires consistent MIME data for all received files.

If you disable this policy setting, Internet Explorer will not require consistent MIME data for all received files.

If you do not configure this policy setting, Internet Explorer requires consistent MIME data for all received files.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_5
GP path: Windows Components/Internet Explorer/Security Features/Consistent Mime Handling
GP ADMX file name: inetres.admx

InternetExplorer/DisableActiveXVersionListAutoDownload

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This setting determines whether IE automatically downloads updated versions of Microsoft’s VersionList.XML. IE uses this file to determine whether an ActiveX control should be stopped from loading.

If you disable or do not configure this setting, IE continues to download updated versions of VersionList.XML.

ADMX Info:

GP Friendly name: Turn off automatic download of the ActiveX VersionList
GP name: VersionListAutomaticDownloadDisable
GP path: Windows Components/Internet Explorer/Security Features/Add-on Management
GP ADMX file name: inetres.admx

Supported values:

0 - Enabled
1 - Disabled (Default)

InternetExplorer/DisableAdobeFlash

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting turns off Adobe Flash in Internet Explorer and prevents applications from using Internet Explorer technology to instantiate Flash objects.

If you enable this policy setting, Flash is turned off for Internet Explorer, and applications cannot use Internet Explorer technology to instantiate Flash objects. In the Manage Add-ons dialog box, the Flash status will be 'Disabled', and users cannot enable Flash. If you enable this policy setting, Internet Explorer will ignore settings made for Adobe Flash through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings.

If you disable, or do not configure this policy setting, Flash is turned on for Internet Explorer, and applications can use Internet Explorer technology to instantiate Flash objects. Users can enable or disable Flash in the Manage Add-ons dialog box.

Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings, even if this policy setting is disabled, or not configured. However, if Adobe Flash is disabled through the "Add-on List" and "Deny all add-ons unless specifically allowed in the Add-on List" policy settings and not through this policy setting, all applications that use Internet Explorer technology to instantiate Flash object can still do so. For more information, see "Group Policy Settings in Internet Explorer 10" in the Internet Explorer TechNet library.

ADMX Info:

GP Friendly name: Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects
GP name: DisableFlashInIE
GP path: Windows Components/Internet Explorer/Security Features/Add-on Management
GP ADMX file name: inetres.admx

InternetExplorer/DisableBypassOfSmartScreenWarnings

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen prevents the user from browsing to or downloading from sites that are known to host malicious content. Windows Defender SmartScreen also prevents the execution of files that are known to be malicious.

If you enable this policy setting, Windows Defender SmartScreen warnings block the user.

If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings.

ADMX Info:

GP Friendly name: Prevent bypassing SmartScreen Filter warnings
GP name: DisableSafetyFilterOverride
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableBypassOfSmartScreenWarningsAboutUncommonFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether the user can bypass warnings from Windows Defender SmartScreen. Windows Defender SmartScreen warns the user about executable files that Internet Explorer users do not commonly download from the Internet.

If you enable this policy setting, Windows Defender SmartScreen warnings block the user.

If you disable or do not configure this policy setting, the user can bypass Windows Defender SmartScreen warnings.

ADMX Info:

GP Friendly name: Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet
GP name: DisableSafetyFilterOverrideForAppRepUnknown
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableCompatView

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls the Compatibility View feature, which allows users to fix website display problems that they may encounter while browsing.

If you enable this policy setting, the user cannot use the Compatibility View button or manage the Compatibility View sites list.

If you disable or do not configure this policy setting, the user can use the Compatibility View button and manage the Compatibility View sites list.

ADMX Info:

GP Friendly name: Turn off Compatibility View
GP name: CompatView_DisableList
GP path: Windows Components/Internet Explorer/Compatibility View
GP ADMX file name: inetres.admx

Supported values:

0 - Disabled (Default)
1 - Enabled

InternetExplorer/DisableConfiguringHistory

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This setting specifies the number of days that Internet Explorer tracks views of pages in the History List. To access the Temporary Internet Files and History Settings dialog box, from the Menu bar, on the Tools menu, click Internet Options, click the General tab, and then click Settings under Browsing history.

If you enable this policy setting, a user cannot set the number of days that Internet Explorer tracks views of the pages in the History List. You must specify the number of days that Internet Explorer tracks views of pages in the History List. Users can not delete browsing history.

If you disable or do not configure this policy setting, a user can set the number of days that Internet Explorer tracks views of pages in the History list. Users can delete browsing history.

ADMX Info:

GP Friendly name: Disable "Configuring History"
GP name: RestrictHistory
GP path: Windows Components/Internet Explorer/Delete Browsing History
GP ADMX file name: inetres.admx

InternetExplorer/DisableCrashDetection

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the crash detection feature of add-on Management.

If you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply.

If you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional.

ADMX Info:

GP Friendly name: Turn off Crash Detection
GP name: AddonManagement_RestrictCrashDetection
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableCustomerExperienceImprovementProgramParticipation

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents the user from participating in the Customer Experience Improvement Program (CEIP).

If you enable this policy setting, the user cannot participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.

If you disable this policy setting, the user must participate in the CEIP, and the Customer Feedback Options command does not appear on the Help menu.

If you do not configure this policy setting, the user can choose to participate in the CEIP.

ADMX Info:

GP Friendly name: Prevent participation in the Customer Experience Improvement Program
GP name: SQM_DisableCEIP
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableDeletingUserVisitedWebsites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents the user from deleting the history of websites that he or she has visited. This feature is available in the Delete Browsing History dialog box.

If you enable this policy setting, websites that the user has visited are preserved when he or she clicks Delete.

If you disable this policy setting, websites that the user has visited are deleted when he or she clicks Delete.

If you do not configure this policy setting, the user can choose whether to delete or preserve visited websites when he or she clicks Delete.

If the "Prevent access to Delete Browsing History" policy setting is enabled, this policy setting is enabled by default.

ADMX Info:

GP Friendly name: Prevent deleting websites that the user has visited
GP name: DBHDisableDeleteHistory
GP path: Windows Components/Internet Explorer/Delete Browsing History
GP ADMX file name: inetres.admx

InternetExplorer/DisableEnclosureDownloading

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents the user from having enclosures (file attachments) downloaded from a feed to the user's computer.

If you enable this policy setting, the user cannot set the Feed Sync Engine to download an enclosure through the Feed property page. A developer cannot change the download setting through the Feed APIs.

If you disable or do not configure this policy setting, the user can set the Feed Sync Engine to download an enclosure through the Feed property page. A developer can change the download setting through the Feed APIs.

ADMX Info:

GP Friendly name: Prevent downloading of enclosures
GP name: Disable_Downloading_of_Enclosures
GP path: Windows Components/RSS Feeds
GP ADMX file name: inetres.admx

InternetExplorer/DisableEncryptionSupport

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to turn off support for Transport Layer Security (TLS) 1.0, TLS 1.1, TLS 1.2, Secure Sockets Layer (SSL) 2.0, or SSL 3.0 in the browser. TLS and SSL are protocols that help protect communication between the browser and the target server. When the browser attempts to set up a protected communication with the target server, the browser and server negotiate which protocol and version to use. The browser and server attempt to match each other’s list of supported protocols and versions, and they select the most preferred match.

If you enable this policy setting, the browser negotiates or does not negotiate an encryption tunnel by using the encryption methods that you select from the drop-down list.

If you disable or do not configure this policy setting, the user can select which encryption method the browser supports.

Note: SSL 2.0 is off by default and is no longer supported starting with Windows 10 Version 1607. SSL 2.0 is an outdated security protocol, and enabling SSL 2.0 impairs the performance and functionality of TLS 1.0.

ADMX Info:

GP Friendly name: Turn off encryption support
GP name: Advanced_SetWinInetProtocols
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/DisableFeedsBackgroundSync

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to choose whether or not to have background synchronization for feeds and Web Slices.

If you enable this policy setting, the ability to synchronize feeds and Web Slices in the background is turned off.

If you disable or do not configure this policy setting, the user can synchronize feeds and Web Slices in the background.

ADMX Info:

GP Friendly name: Turn off background synchronization for feeds and Web Slices
GP name: Disable_Background_Syncing
GP path: Windows Components/RSS Feeds
GP ADMX file name: inetres.admx

Supported values:

0 - Enabled (Default)
1 - Disabled

InternetExplorer/DisableFirstRunWizard

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents Internet Explorer from running the First Run wizard the first time a user starts the browser after installing Internet Explorer or Windows.

If you enable this policy setting, you must make one of the following choices:

Skip the First Run wizard, and go directly to the user's home page.
Skip the First Run wizard, and go directly to the "Welcome to Internet Explorer" webpage.

Starting with Windows 8, the "Welcome to Internet Explorer" webpage is not available. The user's home page will display regardless of which option is chosen.

If you disable or do not configure this policy setting, Internet Explorer may run the First Run wizard the first time the browser is started after installation.

ADMX Info:

GP Friendly name: Prevent running First Run wizard
GP name: NoFirstRunCustomise
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableFlipAheadFeature

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether a user can swipe across a screen or click Forward to go to the next pre-loaded page of a website.

Microsoft collects your browsing history to improve how flip ahead with page prediction works. This feature isn't available for Internet Explorer for the desktop.

If you enable this policy setting, flip ahead with page prediction is turned off and the next webpage isn't loaded into the background.

If you disable this policy setting, flip ahead with page prediction is turned on and the next webpage is loaded into the background.

If you don't configure this setting, users can turn this behavior on or off, using the Settings charm.

ADMX Info:

GP Friendly name: Turn off the flip ahead with page prediction feature
GP name: Advanced_DisableFlipAhead
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/DisableGeolocation

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to disable browser geolocation support. This prevents websites from requesting location data about the user.

If you enable this policy setting, browser geolocation support is turned off.

If you disable this policy setting, browser geolocation support is turned on.

If you do not configure this policy setting, browser geolocation support can be turned on or off in Internet Options on the Privacy tab.

ADMX Info:

GP Friendly name: Turn off browser geolocation
GP name: GeolocationDisable
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

Supported values:

0 - Disabled (Default)
1 - Enabled

InternetExplorer/DisableHomePageChange

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

The Home page specified on the General tab of the Internet Options dialog box is the default Web page that Internet Explorer loads whenever it is run.

If you enable this policy setting, a user cannot set a custom default home page. You must specify which default home page should load on the user machine. For machines with at least Internet Explorer 7, the home page can be set within this policy to override other home page policies.

If you disable or do not configure this policy setting, the Home page box is enabled and users can choose their own home page.

ADMX Info:

GP Friendly name: Disable changing home page settings
GP name: RestrictHomePage
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableInternetExplorerApp

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy lets you restrict launching of Internet Explorer as a standalone browser.

If you enable this policy, it:

Prevents Internet Explorer 11 from launching as a standalone browser.
Restricts Internet Explorer's usage to Microsoft Edge's native 'Internet Explorer mode'.
Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.
Overrides any other policies that redirect to Internet Explorer 11.

If you disable, or do not configure this policy, all sites are opened using the current active browser settings.

ADMX Info:

GP Friendly name: Disable Internet Explorer 11 as a standalone browser
GP name: DisableInternetExplorerApp
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

 <policy name="DisableInternetExplorerApp" class="Both" displayName="$(string.DisableInternetExplorerApp)" explainText="$(string.IE_ExplainDisableInternetExplorerApp)" key="Software\Policies\Microsoft\Internet Explorer\Main" valueName="DisableInternetExplorerApp">

      <parentCategory ref="InternetExplorer" />

      <supportedOn ref="SUPPORTED_IE11" />

      <enabledValue>

        <decimal value="1" />

      </enabledValue>

      <disabledValue>

        <decimal value="0" />

      </disabledValue>

    </policy>

InternetExplorer/DisableIgnoringCertificateErrors

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents the user from ignoring Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate errors that interrupt browsing (such as "expired", "revoked", or "name mismatch" errors) in Internet Explorer.

If you enable this policy setting, the user cannot continue browsing.

If you disable or do not configure this policy setting, the user can choose to ignore certificate errors and continue browsing.

ADMX Info:

GP Friendly name: Prevent ignoring certificate errors
GP name: NoCertError
GP path: Windows Components/Internet Explorer/Internet Control Panel
GP ADMX file name: inetres.admx

InternetExplorer/DisableInPrivateBrowsing

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to turn off the InPrivate Browsing feature.

InPrivate Browsing prevents Internet Explorer from storing data about a user's browsing session. This includes cookies, temporary Internet files, history, and other data.

If you enable this policy setting, InPrivate Browsing is turned off.

If you disable this policy setting, InPrivate Browsing is available for use.

If you do not configure this policy setting, InPrivate Browsing can be turned on or off through the registry.

ADMX Info:

GP Friendly name: Turn off InPrivate Browsing
GP name: DisableInPrivateBrowsing
GP path: Windows Components/Internet Explorer/Privacy
GP ADMX file name: inetres.admx

InternetExplorer/DisableProcessesInEnhancedProtectedMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer 11 uses 64-bit processes (for greater security) or 32-bit processes (for greater compatibility) when running in Enhanced Protected Mode on 64-bit versions of Windows.

Important: Some ActiveX controls and toolbars may not be available when 64-bit processes are used.

If you enable this policy setting, Internet Explorer 11 will use 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you disable this policy setting, Internet Explorer 11 will use 32-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows.

If you don't configure this policy setting, users can turn this feature on or off using Internet Explorer settings. This feature is turned off by default.

ADMX Info:

GP Friendly name: Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows
GP name: Advanced_EnableEnhancedProtectedMode64Bit
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/DisableProxyChange

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting specifies if a user can change proxy settings.

If you enable this policy setting, the user will not be able to configure proxy settings.

If you disable or do not configure this policy setting, the user can configure proxy settings.

ADMX Info:

GP Friendly name: Prevent changing proxy settings
GP name: RestrictProxy
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableSearchProviderChange

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents the user from changing the default search provider for the Address bar and the toolbar Search box.

If you enable this policy setting, the user cannot change the default search provider.

If you disable or do not configure this policy setting, the user can change the default search provider.

ADMX Info:

GP Friendly name: Prevent changing the default search provider
GP name: NoSearchProvider
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableSecondaryHomePageChange

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.

If you enable this policy setting, you can specify which default home pages should load as secondary home pages. The user cannot set custom default secondary home pages.

If you disable or do not configure this policy setting, the user can add secondary home pages.

Note: If the “Disable Changing Home Page Settings” policy is enabled, the user cannot add secondary home pages.

ADMX Info:

GP Friendly name: Disable changing secondary home page settings
GP name: SecondaryHomePages
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableSecuritySettingsCheck

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting turns off the Security Settings Check feature, which checks Internet Explorer security settings to determine when the settings put Internet Explorer at risk.

If you enable this policy setting, the feature is turned off.

If you disable or do not configure this policy setting, the feature is turned on.

ADMX Info:

GP Friendly name: Turn off the Security Settings Check feature
GP name: Disable_Security_Settings_Check
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableUpdateCheck

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Prevents Internet Explorer from checking whether a new version of the browser is available.

If you enable this policy, it prevents Internet Explorer from checking to see whether it is the latest available browser version and notifying users if a new version is available.

If you disable this policy or do not configure it, Internet Explorer checks every 30 days by default, and then notifies users if a new version is available.

This policy is intended to help the administrator maintain version control for Internet Explorer by preventing users from being notified about new versions of the browser.

ADMX Info:

GP Friendly name: Disable Periodic Check for Internet Explorer software updates
GP name: NoUpdateCheck
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DisableWebAddressAutoComplete

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This AutoComplete feature suggests possible matches when users are entering Web addresses in the browser address bar.

If you enable this policy setting, users are not suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.

If you disable this policy setting, users are suggested matches when entering Web addresses. The user cannot change the auto-complete for web-address setting.

If you do not configure this policy setting, users can choose to turn the auto-complete setting for web-addresses on or off.

ADMX Info:

GP Friendly name: Turn off the auto-complete feature for web addresses
GP name: RestrictWebAddressSuggest
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

Supported values:

yes - Disabled (Default)
no - Enabled

InternetExplorer/DoNotAllowActiveXControlsInProtectedMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents ActiveX controls from running in Protected Mode when Enhanced Protected Mode is enabled. When a user has an ActiveX control installed that is not compatible with Enhanced Protected Mode and a website attempts to load the control, Internet Explorer notifies the user and gives the option to run the website in regular Protected Mode. This policy setting disables this notification and forces all websites to run in Enhanced Protected Mode.

When Enhanced Protected Mode is enabled, and a user encounters a website that attempts to load an ActiveX control that is not compatible with Enhanced Protected Mode, Internet Explorer notifies the user and gives the option to disable Enhanced Protected Mode for that particular website.

If you enable this policy setting, Internet Explorer will not give the user the option to disable Enhanced Protected Mode. All Protected Mode websites will run in Enhanced Protected Mode.

If you disable or do not configure this policy setting, Internet Explorer notifies users and provides an option to run websites with incompatible ActiveX controls in regular Protected Mode. This is the default behavior.

ADMX Info:

GP Friendly name: Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled
GP name: Advanced_DisableEPMCompat
GP path: Windows Components/Internet Explorer/Internet Control Panel/Advanced Page
GP ADMX file name: inetres.admx

InternetExplorer/DoNotAllowUsersToAddSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.

If you enable this policy, the site management settings for security zones are disabled. (To see the site management settings for security zones, in the Internet Options dialog box, click the Security tab, and then click the Sites button.)

If you disable this policy or do not configure it, users can add Web sites to or remove sites from the Trusted Sites and Restricted Sites zones, and alter settings for the Local Intranet zone.

This policy prevents users from changing site management settings for security zones established by the administrator.

Note: The "Disable the Security page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from the interface, takes precedence over this policy. If it is enabled, this policy is ignored.

Also, see the "Security zones: Use only machine settings" policy.

ADMX Info:

GP Friendly name: Security Zones: Do not allow users to add/delete sites
GP name: Security_zones_map_edit
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DoNotAllowUsersToChangePolicies

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.

If you enable this policy, the Custom Level button and security-level slider on the Security tab in the Internet Options dialog box are disabled.

If you disable this policy or do not configure it, users can change the settings for security zones.

This policy prevents users from changing security zone settings established by the administrator.

Note: The "Disable the Security page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

Also, see the "Security zones: Use only machine settings" policy.

ADMX Info:

GP Friendly name: Security Zones: Do not allow users to change policies
GP name: Security_options_edit
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/DoNotBlockOutdatedActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer blocks specific outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

If you enable this policy setting, Internet Explorer stops blocking outdated ActiveX controls.

If you disable or don't configure this policy setting, Internet Explorer continues to block specific outdated ActiveX controls.

For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.

ADMX Info:

GP Friendly name: Turn off blocking of outdated ActiveX controls for Internet Explorer
GP name: VerMgmtDisable
GP path: Windows Components/Internet Explorer/Security Features/Add-on Management
GP ADMX file name: inetres.admx

InternetExplorer/DoNotBlockOutdatedActiveXControlsOnSpecificDomains

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage a list of domains on which Internet Explorer will stop blocking outdated ActiveX controls. Outdated ActiveX controls are never blocked in the Intranet Zone.

If you enable this policy setting, you can enter a custom list of domains for which outdated ActiveX controls won't be blocked in Internet Explorer. Each domain entry must be formatted like one of the following:

"domain.name.TLD". For example, if you want to include .contoso.com/, use "contoso.com"
"hostname". For example, if you want to include http://example, use "example"
"file:///path/filename.htm". For example, use "file:///C:/Users/contoso/Desktop/index.htm"

If you disable or don't configure this policy setting, the list is deleted and Internet Explorer continues to block specific outdated ActiveX controls on all domains in the Internet Zone.

For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.

ADMX Info:

GP Friendly name: Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains
GP name: VerMgmtDomainAllowlist
GP path: Windows Components/Internet Explorer/Security Features/Add-on Management
GP ADMX file name: inetres.admx

InternetExplorer/IncludeAllLocalSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.

If you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.

If you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).

If you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone.

ADMX Info:

GP Friendly name: Intranet Sites: Include all local (intranet) sites not listed in other zones
GP name: IZ_IncludeUnspecifiedLocalSites
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/IncludeAllNetworkPaths

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.

If you enable this policy setting, all network paths are mapped into the Intranet Zone.

If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).

If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.

ADMX Info:

GP Friendly name: Intranet Sites: Include all network paths (UNCs)
GP name: IZ_UNCAsIntranet
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Notification bar instead of the file download dialog. Users can then click the Notification bar to allow the file download prompt.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowCopyPasteViaScript

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.

If you enable this policy setting, a script can perform a clipboard operation.

If you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.

If you disable this policy setting, a script cannot perform a clipboard operation.

If you do not configure this policy setting, a script can perform a clipboard operation.

ADMX Info:

GP Friendly name: Allow cut, copy or paste operations from the clipboard via script
GP name: IZ_PolicyAllowPasteViaScript_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowDragAndDropCopyAndPasteFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.

If you enable this policy setting, users can drag files or copy and paste files from this zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from this zone.

If you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.

If you do not configure this policy setting, users can drag files or copy and paste files from this zone automatically.

ADMX Info:

GP Friendly name: Allow drag and drop or copy and paste files
GP name: IZ_PolicyDropOrPasteFiles_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.

If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.

If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.

If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowLoadingOfXAMLFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the loading of Extensible Application Markup Language (XAML) files. XAML is an XML-based declarative markup language commonly used for creating rich user interfaces and graphics that take advantage of the Windows Presentation Foundation.

If you enable this policy setting and set the drop-down box to Enable, XAML files are automatically loaded inside Internet Explorer. The user cannot change this behavior. If you set the drop-down box to Prompt, the user is prompted for loading XAML files.

If you disable this policy setting, XAML files are not loaded inside Internet Explorer. The user cannot change this behavior.

If you do not configure this policy setting, the user can decide whether to load XAML files inside Internet Explorer.

ADMX Info:

GP Friendly name: Allow loading of XAML files
GP name: IZ_Policy_XAML_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.

If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control.

If you enable this policy setting, the user is prompted before ActiveX controls can run from websites in this zone. The user can choose to allow the control to run from the current site or from all sites.

If you disable this policy setting, the user does not see the per-site ActiveX prompt, and ActiveX controls can run from all sites in this zone.

ADMX Info:

GP Friendly name: Allow only approved domains to use ActiveX controls without prompt
GP name: IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether or not the user is allowed to run the TDC ActiveX control on websites.

If you enable this policy setting, the TDC ActiveX control will not run from websites in this zone.

If you disable this policy setting, the TDC Active X control will run from all sites in this zone.

ADMX Info:

GP Friendly name: Allow only approved domains to use the TDC ActiveX control
GP name: IZ_PolicyAllowTDCControl_Both_Internet
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowScriptInitiatedWindows

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.

If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.

If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in this zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

ADMX Info:

GP Friendly name: Allow script-initiated windows without size or position constraints
GP name: IZ_PolicyWindowsRestrictionsURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowScriptingOfInternetExplorerWebBrowserControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether a page can control embedded WebBrowser controls via script.

If you enable this policy setting, script access to the WebBrowser control is allowed.

If you disable this policy setting, script access to the WebBrowser control is not allowed.

If you do not configure this policy setting, the user can enable or disable script access to the WebBrowser control. By default, script access to the WebBrowser control is allowed only in the Local Machine and Intranet zones.

ADMX Info:

GP Friendly name: Allow scripting of Internet Explorer WebBrowser controls
GP name: IZ_Policy_WebBrowserControl_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowUpdatesToStatusBarViaScript

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether script is allowed to update the status bar within the zone.

If you enable this policy setting, script is allowed to update the status bar.

If you disable or do not configure this policy setting, script is not allowed to update the status bar.

ADMX Info:

GP Friendly name: Allow updates to status bar via script
GP name: IZ_Policy_ScriptStatusBar_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneAllowVBScriptToRunInInternetExplorer

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer.

If you selected Enable in the drop-down box, VBScript can run without user intervention.

If you selected Prompt in the drop-down box, users are asked to choose whether to allow VBScript to run.

If you selected Disable in the drop-down box, VBScript is prevented from running.

If you do not configure or disable this policy setting, VBScript is prevented from running.

ADMX Info:

GP Friendly name: Allow VBScript to run in Internet Explorer
GP name: IZ_PolicyAllowVBScript_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneDoNotRunAntimalwareAgainstActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.

ADMX Info:

GP Friendly name: Don't run antimalware programs against ActiveX controls
GP name: IZ_PolicyAntiMalwareCheckingOfActiveXControls_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneDownloadSignedActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.

If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.

If you disable the policy setting, signed controls cannot be downloaded.

If you do not configure this policy setting, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.

ADMX Info:

GP Friendly name: Download signed ActiveX controls
GP name: IZ_PolicyDownloadSignedActiveX_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneDownloadUnsignedActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.

If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.

If you disable this policy setting, users cannot run unsigned controls.

If you do not configure this policy setting, users cannot run unsigned controls.

ADMX Info:

GP Friendly name: Download unsigned ActiveX controls
GP name: IZ_PolicyDownloadUnsignedActiveX_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneEnableCrossSiteScriptingFilter

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injections into websites in this zone.

If you enable this policy setting, the XSS Filter is turned on for sites in this zone, and the XSS Filter attempts to block cross-site script injections.

If you disable this policy setting, the XSS Filter is turned off for sites in this zone, and Internet Explorer permits cross-site script injections.

ADMX Info:

GP Friendly name: Turn on Cross-Site Scripting Filter
GP name: IZ_PolicyTurnOnXSSFilter_Both_Internet
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows.

If you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting.

If you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when both the source and destination are in different windows. Users cannot change this setting.

In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in different windows. Users can change this setting in the Internet Options dialog.

In Internet Explorer 9 and earlier versions, if you disable this policy or do not configure it, users can drag content from one domain to a different domain when the source and destination are in different windows. Users cannot change this setting.

ADMX Info:

GP Friendly name: Enable dragging of content from different domains across windows
GP name: IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window.

If you enable this policy setting and click Enable, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting.

If you enable this policy setting and click Disable, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog.

In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.

In Internet Explorer 9 and earlier versions, if you disable this policy setting or do not configure it, users can drag content from one domain to a different domain when the source and destination are in the same window. Users cannot change this setting in the Internet Options dialog.

ADMX Info:

GP Friendly name: Enable dragging of content from different domains within a window
GP name: IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneEnableMIMESniffing

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.

If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.

If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.

If you do not configure this policy setting, the MIME Sniffing Safety Feature will not apply in this zone.

ADMX Info:

GP Friendly name: Enable MIME Sniffing
GP name: IZ_PolicyMimeSniffingURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneEnableProtectedMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to turn on Protected Mode. Protected Mode helps protect Internet Explorer from exploited vulnerabilities by reducing the locations that Internet Explorer can write to in the registry and the file system.

If you enable this policy setting, Protected Mode is turned on. The user cannot turn off Protected Mode.

If you disable this policy setting, Protected Mode is turned off. The user cannot turn on Protected Mode.

If you do not configure this policy setting, the user can turn on or turn off Protected Mode.

ADMX Info:

GP Friendly name: Turn on Protected Mode
GP name: IZ_Policy_TurnOnProtectedMode_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneIncludeLocalPathWhenUploadingFilesToServer

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether or not local path information is sent when the user is uploading a file via an HTML form. If the local path information is sent, some information may be unintentionally revealed to the server. For instance, files sent from the user's desktop may contain the user name as a part of the path.

If you enable this policy setting, path information is sent when the user is uploading a file via an HTML form.

If you disable this policy setting, path information is removed when the user is uploading a file via an HTML form.

If you do not configure this policy setting, the user can choose whether path information is sent when he or she is uploading a file via an HTML form. By default, path information is sent.

ADMX Info:

GP Friendly name: Include local path when user is uploading files to a server
GP name: IZ_Policy_LocalPathForUpload_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneInitializeAndScriptActiveXControlsNotMarkedSafe

Edition	Windows 10	Windows 11
Home	Yes	Yes
Pro	Yes	Yes
Business
Enterprise	Yes	Yes
Education	Yes	Yes

InternetExplorer/InternetZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, the permission is set to High Safety.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneLaunchingApplicationsAndFilesInIFRAME

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.

If you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.

If you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

If you do not configure this policy setting, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.

ADMX Info:

GP Friendly name: Launching applications and files in an IFRAME
GP name: IZ_PolicyLaunchAppsAndFilesInIFRAME_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneLogonOptions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage settings for logon options.

If you enable this policy setting, you can choose from the following logon options.

Anonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.

Prompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.

If you disable this policy setting, logon is set to Automatic logon only in Intranet zone.

If you do not configure this policy setting, logon is set to Automatic logon only in Intranet zone.

ADMX Info:

GP Friendly name: Logon options
GP name: IZ_PolicyLogon_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you enable this policy setting, users can open windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow windows and frames to access applications from other domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.

If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.

If you disable this policy setting, Internet Explorer will not execute signed managed components.

If you do not configure this policy setting, Internet Explorer will execute signed managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components signed with Authenticode
GP name: IZ_PolicySignedFrameworkComponentsURLaction_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneShowSecurityWarningForPotentiallyUnsafeFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether or not the "Open File - Security Warning" message appears when the user tries to open executable files or other potentially unsafe files (from an intranet file share by using File Explorer, for example).

If you enable this policy setting and set the drop-down box to Enable, these files open without a security warning. If you set the drop-down box to Prompt, a security warning appears before the files open.

If you disable this policy setting, these files do not open.

If you do not configure this policy setting, the user can configure how the computer handles these files. By default, these files are blocked in the Restricted zone, enabled in the Intranet and Local Computer zones, and set to prompt in the Internet and Trusted zones.

ADMX Info:

GP Friendly name: Show security warning for potentially unsafe files
GP name: IZ_Policy_UnsafeFiles_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/InternetZoneUsePopupBlocker

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.

If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.

If you disable this policy setting, pop-up windows are not prevented from appearing.

If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.

ADMX Info:

GP Friendly name: Use Pop-up Blocker
GP name: IZ_PolicyBlockPopupWindows_1
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.

If you do not configure this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneDoNotRunAntimalwareAgainstActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you don't configure this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control. Users can turn this behavior on or off, using Internet Explorer Security settings.

ADMX Info:

GP Friendly name: Don't run antimalware programs against ActiveX controls
GP name: IZ_PolicyAntiMalwareCheckingOfActiveXControls_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, the permission is set to Medium Safety.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/IntranetZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_3
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/KeepIntranetSitesInInternetExplorer

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents intranet sites from being opened in any browser except Internet Explorer.

If you enable this policy, all intranet sites are opened in Internet Explorer 11. The only exceptions are sites listed in your Enterprise Mode Site List. If you disable or do not configure this policy, all intranet sites are automatically opened in Microsoft Edge.

We strongly recommend keeping this policy in sync with the Browser/SendIntranetTraffictoInternetExplorer policy. Additionally, it is best to enable this policy only if your intranet sites have known compatibility problems with Microsoft Edge.

Related policies:

Browser/SendIntranetTraffictoInternetExplorer
InternetExplorer/SendSitesNotInEnterpriseSiteListToEdge

For more information on how to use this policy together with other related policies to create the optimal configuration for your organization, see https://go.microsoft.com/fwlink/?linkid=2094210.

ADMX Info:

GP Friendly name: Keep all Intranet Sites in Internet Explorer
GP name: KeepIntranetSitesInInternetExplorer
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

 <policy name="KeepIntranetSitesInInternetExplorer" class="Both" displayName="$(string.KeepIntranetSitesInInternetExplorer)" explainText="$(string.IE_ExplainKeepIntranetSitesInInternetExplorer)" key="Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode" valueName="KeepIntranetSitesInInternetExplorer">

      <parentCategory ref="InternetExplorer" />

      <supportedOn ref="SUPPORTED_IE11" />

      <enabledValue>

        <decimal value="1" />

      </enabledValue>

      <disabledValue>

        <decimal value="0" />

      </disabledValue>

    </policy>

InternetExplorer/LocalMachineZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in this zone as set by Protection from Zone Elevation feature control.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneDoNotRunAntimalwareAgainstActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

ADMX Info:

GP Friendly name: Don't run antimalware programs against ActiveX controls
GP name: IZ_PolicyAntiMalwareCheckingOfActiveXControls_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, the permission is set to Medium Safety.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LocalMachineZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_9
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownInternetZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_2
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownIntranetZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_4
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownLocalMachineZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_10
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, users are queried whether to allow HTML fonts to download.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownRestrictedSitesZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you enable this policy setting, users can open additional windows and frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional windows and frames to access applications from other domains.

If you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.

If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_8
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/LockedDownTrustedSitesZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_6
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/MKProtocolSecurityRestrictionInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

The MK Protocol Security Restriction policy setting reduces attack surface area by preventing the MK protocol. Resources hosted on the MK protocol will fail.

If you enable this policy setting, the MK Protocol is prevented for File Explorer and Internet Explorer, and resources hosted on the MK protocol will fail.

If you disable this policy setting, applications can use the MK protocol API. Resources hosted on the MK protocol will work for the File Explorer and Internet Explorer processes.

If you do not configure this policy setting, the MK Protocol is prevented for File Explorer and Internet Explorer, and resources hosted on the MK protocol will fail.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_3
GP path: Windows Components/Internet Explorer/Security Features/MK Protocol Security Restriction
GP ADMX file name: inetres.admx

InternetExplorer/MimeSniffingSafetyFeatureInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer MIME sniffing will prevent promotion of a file of one type to a more dangerous file type.

If you enable this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type.

If you disable this policy setting, Internet Explorer processes will allow a MIME sniff promoting a file of one type to a more dangerous file type.

If you do not configure this policy setting, MIME sniffing will never promote a file of one type to a more dangerous file type.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_6
GP path: Windows Components/Internet Explorer/Security Features/Mime Sniffing Safety Feature
GP ADMX file name: inetres.admx

InternetExplorer/NewTabDefaultPage

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to specify what is displayed when the user opens a new tab.

If you enable this policy setting, you can choose which page to display when the user opens a new tab: blank page (about:blank), the first home page, the new tab page or the new tab page with my news feed.

If you disable or do not configure this policy setting, users can select their preference for this behavior.

ADMX Info:

GP Friendly name: Specify default behavior for a new tab
GP name: NewTabAction
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

Supported values:

0 - NewTab_AboutBlank (about:blank)
1 - NewTab_Homepage (Home page)
2 - NewTab_AboutTabs (New tab page)
3 - NewTab_AboutNewsFeed (New tab page with my news feed) (Default)

InternetExplorer/NotificationBarInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the Notification bar is displayed for Internet Explorer processes when file or code installs are restricted. By default, the Notification bar is displayed for Internet Explorer processes.

If you enable this policy setting, the Notification bar will be displayed for Internet Explorer Processes.

If you disable this policy setting, the Notification bar will not be displayed for Internet Explorer processes.

If you do not configure this policy setting, the Notification bar will be displayed for Internet Explorer Processes.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_10
GP path: Windows Components/Internet Explorer/Security Features/Notification bar
GP ADMX file name: inetres.admx

InternetExplorer/PreventManagingSmartScreenFilter

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting prevents the user from managing Windows Defender SmartScreen, which warns the user if the website being visited is known for fraudulent attempts to gather personal information through "phishing," or is known to host malware.

If you enable this policy setting, the user is not prompted to turn on Windows Defender SmartScreen. All website addresses that are not on the filter's allow list are sent automatically to Microsoft without prompting the user.

If you disable or do not configure this policy setting, the user is prompted to decide whether to turn on Windows Defender SmartScreen during the first-run experience.

ADMX Info:

GP Friendly name: Prevent managing SmartScreen Filter
GP name: Disable_Managing_Safety_Filter_IE9
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/PreventPerUserInstallationOfActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to prevent the installation of ActiveX controls on a per-user basis.

If you enable this policy setting, ActiveX controls cannot be installed on a per-user basis.

If you disable or do not configure this policy setting, ActiveX controls can be installed on a per-user basis.

ADMX Info:

GP Friendly name: Prevent per-user installation of ActiveX controls
GP name: DisablePerUserActiveXInstall
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/ProtectionFromZoneElevationInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Internet Explorer places restrictions on each Web page it opens. The restrictions are dependent upon the location of the Web page (Internet, Intranet, Local Machine zone, etc.). Web pages on the local computer have the fewest security restrictions and reside in the Local Machine zone, making the Local Machine security zone a prime target for malicious users. Zone Elevation also disables JavaScript navigation if there is no security context.

If you enable this policy setting, any zone can be protected from zone elevation by Internet Explorer processes.

If you disable this policy setting, no zone receives such protection for Internet Explorer processes.

If you do not configure this policy setting, any zone can be protected from zone elevation by Internet Explorer processes.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_9
GP path: Windows Components/Internet Explorer/Security Features/Protection From Zone Elevation
GP ADMX file name: inetres.admx

InternetExplorer/RemoveRunThisTimeButtonForOutdatedActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to stop users from seeing the "Run this time" button and from running specific outdated ActiveX controls in Internet Explorer.

If you enable this policy setting, users won't see the "Run this time" button on the warning message that appears when Internet Explorer blocks an outdated ActiveX control.

If you disable or don't configure this policy setting, users will see the "Run this time" button on the warning message that appears when Internet Explorer blocks an outdated ActiveX control. Clicking this button lets the user run the outdated ActiveX control once.

For more information, see "Outdated ActiveX Controls" in the Internet Explorer TechNet library.

ADMX Info:

GP Friendly name: Remove "Run this time" button for outdated ActiveX controls in Internet Explorer
GP name: VerMgmtDisableRunThisTime
GP path: Windows Components/Internet Explorer/Security Features/Add-on Management
GP ADMX file name: inetres.admx

InternetExplorer/RestrictActiveXInstallInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting enables blocking of ActiveX control installation prompts for Internet Explorer processes.

If you enable this policy setting, prompting for ActiveX control installations will be blocked for Internet Explorer processes.

If you disable this policy setting, prompting for ActiveX control installations will not be blocked for Internet Explorer processes.

If you do not configure this policy setting, the user's preference will be used to determine whether to block ActiveX control installations for Internet Explorer processes.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_11
GP path: Windows Components/Internet Explorer/Security Features/Restrict ActiveX Install
GP ADMX file name: inetres.admx

InternetExplorer/RestrictFileDownloadInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting enables blocking of file download prompts that are not user initiated.

If you enable this policy setting, file download prompts that are not user initiated will be blocked for Internet Explorer processes.

If you disable this policy setting, prompting will occur for file downloads that are not user initiated for Internet Explorer processes.

If you do not configure this policy setting, the user's preference determines whether to prompt for file downloads that are not user initiated for Internet Explorer processes.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_12
GP path: Windows Components/Internet Explorer/Security Features/Restrict File Download
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowActiveScripting

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether script code on pages in the zone is run.

If you enable this policy setting, script code on pages in the zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the zone to run.

If you disable this policy setting, script code on pages in the zone is prevented from running.

If you do not configure this policy setting, script code on pages in the zone is prevented from running.

ADMX Info:

GP Friendly name: Allow active scripting
GP name: IZ_PolicyActiveScripting_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowBinaryAndScriptBehaviors

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.

If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.

If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.

If you do not configure this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.

ADMX Info:

GP Friendly name: Allow binary and script behaviors
GP name: IZ_PolicyBinaryBehaviors_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowCopyPasteViaScript

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.

If you enable this policy setting, a script can perform a clipboard operation.

If you select Prompt in the drop-down box, users are queried as to whether to perform clipboard operations.

If you disable this policy setting, a script cannot perform a clipboard operation.

If you do not configure this policy setting, a script cannot perform a clipboard operation.

ADMX Info:

GP Friendly name: Allow cut, copy or paste operations from the clipboard via script
GP name: IZ_PolicyAllowPasteViaScript_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowDragAndDropCopyAndPasteFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the zone.

If you disable this policy setting, users are prevented from dragging files or copying and pasting files from this zone.

If you do not configure this policy setting, users are queried to choose whether to drag or copy files from this zone.

ADMX Info:

GP Friendly name: Allow drag and drop or copy and paste files
GP name: IZ_PolicyDropOrPasteFiles_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether file downloads are permitted from the zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.

If you enable this policy setting, files can be downloaded from the zone.

If you disable this policy setting, files are prevented from being downloaded from the zone.

If you do not configure this policy setting, files are prevented from being downloaded from the zone.

ADMX Info:

GP Friendly name: Allow file downloads
GP name: IZ_PolicyFileDownload_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, users are queried whether to allow HTML fonts to download.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate into this zone.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowLoadingOfXAMLFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, XAML files are not loaded inside Internet Explorer. The user cannot change this behavior.

If you do not configure this policy setting, the user can decide whether to load XAML files inside Internet Explorer.

ADMX Info:

GP Friendly name: Allow loading of XAML files
GP name: IZ_Policy_XAML_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowMETAREFRESH

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page.

If you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting can be redirected to another Web page.

If you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.

If you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting cannot be redirected to another Web page.

ADMX Info:

GP Friendly name: Allow META REFRESH
GP name: IZ_PolicyAllowMETAREFRESH_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether or not the user is prompted to allow ActiveX controls to run on websites other than the website that installed the ActiveX control.

If you disable this policy setting, the user does not see the per-site ActiveX prompt, and ActiveX controls can run from all sites in this zone.

ADMX Info:

GP Friendly name: Allow only approved domains to use ActiveX controls without prompt
GP name: IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowOnlyApprovedDomainsToUseTDCActiveXControl

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether or not the user is allowed to run the TDC ActiveX control on websites.

If you enable this policy setting, the TDC ActiveX control will not run from websites in this zone.

If you disable this policy setting, the TDC Active X control will run from all sites in this zone.

ADMX Info:

GP Friendly name: Allow only approved domains to use the TDC ActiveX control
GP name: IZ_PolicyAllowTDCControl_Both_Restricted
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowScriptInitiatedWindows

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.

If you enable this policy setting, Windows Restrictions security will not apply in this zone. The security zone runs without the added layer of security provided by this feature.

ADMX Info:

GP Friendly name: Allow script-initiated windows without size or position constraints
GP name: IZ_PolicyWindowsRestrictionsURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowScriptingOfInternetExplorerWebBrowserControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether a page can control embedded WebBrowser controls via script.

If you enable this policy setting, script access to the WebBrowser control is allowed.

If you disable this policy setting, script access to the WebBrowser control is not allowed.

ADMX Info:

GP Friendly name: Allow scripting of Internet Explorer WebBrowser controls
GP name: IZ_Policy_WebBrowserControl_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowUpdatesToStatusBarViaScript

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether script is allowed to update the status bar within the zone.

If you enable this policy setting, script is allowed to update the status bar.

If you disable or do not configure this policy setting, script is not allowed to update the status bar.

ADMX Info:

GP Friendly name: Allow updates to status bar via script
GP name: IZ_Policy_ScriptStatusBar_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneAllowVBScriptToRunInInternetExplorer

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether VBScript can be run on pages from the specified zone in Internet Explorer.

If you selected Enable in the drop-down box, VBScript can run without user intervention.

If you selected Prompt in the drop-down box, users are asked to choose whether to allow VBScript to run.

If you selected Disable in the drop-down box, VBScript is prevented from running.

If you do not configure or disable this policy setting, VBScript is prevented from running.

ADMX Info:

GP Friendly name: Allow VBScript to run in Internet Explorer
GP name: IZ_PolicyAllowVBScript_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneDoNotRunAntimalwareAgainstActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

ADMX Info:

GP Friendly name: Don't run antimalware programs against ActiveX controls
GP name: IZ_PolicyAntiMalwareCheckingOfActiveXControls_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneDownloadSignedActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.

If you disable the policy setting, signed controls cannot be downloaded.

If you do not configure this policy setting, signed controls cannot be downloaded.

ADMX Info:

GP Friendly name: Download signed ActiveX controls
GP name: IZ_PolicyDownloadSignedActiveX_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneDownloadUnsignedActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.

If you disable this policy setting, users cannot run unsigned controls.

If you do not configure this policy setting, users cannot run unsigned controls.

ADMX Info:

GP Friendly name: Download unsigned ActiveX controls
GP name: IZ_PolicyDownloadUnsignedActiveX_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneEnableCrossSiteScriptingFilter

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy controls whether or not the Cross-Site Scripting (XSS) Filter will detect and prevent cross-site script injections into websites in this zone.

If you enable this policy setting, the XSS Filter is turned on for sites in this zone, and the XSS Filter attempts to block cross-site script injections.

If you disable this policy setting, the XSS Filter is turned off for sites in this zone, and Internet Explorer permits cross-site script injections.

ADMX Info:

GP Friendly name: Turn on Cross-Site Scripting Filter
GP name: IZ_PolicyTurnOnXSSFilter_Both_Restricted
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsAcrossWindows

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in different windows.

ADMX Info:

GP Friendly name: Enable dragging of content from different domains across windows
GP name: IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneEnableDraggingOfContentFromDifferentDomainsWithinWindows

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to set options for dragging content from one domain to a different domain when the source and destination are in the same window.

In Internet Explorer 10, if you disable this policy setting or do not configure it, users cannot drag content from one domain to a different domain when the source and destination are in the same window. Users can change this setting in the Internet Options dialog.

ADMX Info:

GP Friendly name: Enable dragging of content from different domains within a window
GP name: IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneEnableMIMESniffing

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in this zone. The security zone will run without the added layer of security provided by this feature.

If you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in this zone, as dictated by the feature control setting for the process.

ADMX Info:

GP Friendly name: Enable MIME Sniffing
GP name: IZ_PolicyMimeSniffingURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneIncludeLocalPathWhenUploadingFilesToServer

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, path information is sent when the user is uploading a file via an HTML form.

If you disable this policy setting, path information is removed when the user is uploading a file via an HTML form.

If you do not configure this policy setting, the user can choose whether path information is sent when he or she is uploading a file via an HTML form. By default, path information is sent.

ADMX Info:

GP Friendly name: Include local path when user is uploading files to a server
GP name: IZ_Policy_LocalPathForUpload_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneLaunchingApplicationsAndFilesInIFRAME

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.

If you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

If you do not configure this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

ADMX Info:

GP Friendly name: Launching applications and files in an IFRAME
GP name: IZ_PolicyLaunchAppsAndFilesInIFRAME_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneLogonOptions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage settings for logon options.

If you enable this policy setting, you can choose from the following logon options.

Anonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.

Prompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.

If you disable this policy setting, logon is set to Automatic logon only in Intranet zone.

If you do not configure this policy setting, logon is set to Prompt for username and password.

ADMX Info:

GP Friendly name: Logon options
GP name: IZ_PolicyLogon_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open other windows and frames from other domains or access applications from different domains.

If you do not configure this policy setting, users cannot open other windows and frames from different domains or access applications from different domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneRunActiveXControlsAndPlugins

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the specified zone.

If you enable this policy setting, controls and plug-ins can run without user intervention.

If you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.

If you disable this policy setting, controls and plug-ins are prevented from running.

If you do not configure this policy setting, controls and plug-ins are prevented from running.

ADMX Info:

GP Friendly name: Run ActiveX controls and plugins
GP name: IZ_PolicyRunActiveXControls_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneRunNETFrameworkReliantComponentsSignedWithAuthenticode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute signed managed components.

If you do not configure this policy setting, Internet Explorer will not execute signed managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components signed with Authenticode
GP name: IZ_PolicySignedFrameworkComponentsURLaction_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneScriptActiveXControlsMarkedSafeForScripting

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.

If you enable this policy setting, script interaction can occur automatically without user intervention.

If you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.

If you disable this policy setting, script interaction is prevented from occurring.

If you do not configure this policy setting, script interaction is prevented from occurring.

ADMX Info:

GP Friendly name: Script ActiveX controls marked safe for scripting
GP name: IZ_PolicyScriptActiveXMarkedSafe_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneScriptingOfJavaApplets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether applets are exposed to scripts within the zone.

If you enable this policy setting, scripts can access applets automatically without user intervention.

If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.

If you disable this policy setting, scripts are prevented from accessing applets.

If you do not configure this policy setting, scripts are prevented from accessing applets.

ADMX Info:

GP Friendly name: Scripting of Java applets
GP name: IZ_PolicyScriptingOfJavaApplets_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneShowSecurityWarningForPotentiallyUnsafeFiles

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, these files do not open.

ADMX Info:

GP Friendly name: Show security warning for potentially unsafe files
GP name: IZ_Policy_UnsafeFiles_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneTurnOnProtectedMode

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, Protected Mode is turned on. The user cannot turn off Protected Mode.

If you disable this policy setting, Protected Mode is turned off. The user cannot turn on Protected Mode.

If you do not configure this policy setting, the user can turn on or turn off Protected Mode.

ADMX Info:

GP Friendly name: Turn on Protected Mode
GP name: IZ_Policy_TurnOnProtectedMode_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/RestrictedSitesZoneUsePopupBlocker

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.

If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.

If you disable this policy setting, pop-up windows are not prevented from appearing.

If you do not configure this policy setting, most unwanted pop-up windows are prevented from appearing.

ADMX Info:

GP Friendly name: Use Pop-up Blocker
GP name: IZ_PolicyBlockPopupWindows_7
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/ScriptedWindowSecurityRestrictionsInternetExplorerProcesses

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Internet Explorer allows scripts to programmatically open, resize, and reposition windows of various types. The Window Restrictions security feature restricts popup windows and prohibits scripts from displaying windows in which the title and status bars are not visible to the user or obfuscate other Windows' title and status bars.

If you enable this policy setting, popup windows and other restrictions apply for File Explorer and Internet Explorer processes.

If you disable this policy setting, scripts can continue to create popup windows and windows that obfuscate other windows.

If you do not configure this policy setting, popup windows and other restrictions apply for File Explorer and Internet Explorer processes.

ADMX Info:

GP Friendly name: Internet Explorer Processes
GP name: IESF_PolicyExplorerProcesses_8
GP path: Windows Components/Internet Explorer/Security Features/Scripted Window Security Restrictions
GP ADMX file name: inetres.admx

InternetExplorer/SearchProviderList

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to restrict the search providers that appear in the Search box in Internet Explorer to those defined in the list of policy keys for search providers (found under [HKCU or HKLM\Software\policies\Microsoft\Internet Explorer\SearchScopes]). Normally, search providers can be added from third-party toolbars or in Setup, but the user can also add them from a search provider's website.

If you enable this policy setting, the user cannot configure the list of search providers on his or her computer, and any default providers installed do not appear (including providers installed from other applications). The only providers that appear are those in the list of policy keys for search providers. Note: This list can be created through a custom administrative template file. For information about creating this custom administrative template file, see the Internet Explorer documentation on search providers.

If you disable or do not configure this policy setting, the user can configure his or her list of search providers.

ADMX Info:

GP Friendly name: Restrict search providers to a specific list
GP name: SpecificSearchProvider
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/SecurityZonesUseOnlyMachineSettings

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level.

If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer.

If you disable this policy or do not configure it, users of the same computer can establish their own security zone settings.

This policy is intended to ensure that security zone settings apply uniformly to the same computer and do not vary from user to user.

Also, see the "Security zones: Do not allow users to change policies" policy.

ADMX Info:

GP Friendly name: Security Zones: Use only machine settings
GP name: Security_HKLM_only
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/SendSitesNotInEnterpriseSiteListToEdge

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This setting lets you decide whether to open all sites not included in the Enterprise Mode Site List in Microsoft Edge. If you use this setting, you must also turn on the InternetExplorer/AllowEnterpriseModeSiteList policy setting and you must include at least one site in the Enterprise Mode Site List.

If you enable this setting, it automatically opens all sites not included in the Enterprise Mode Site List in Microsoft Edge.

If you disable, or not configure this setting, then it opens all sites based on the currently active browser.

ADMX Info:

GP Friendly name: Send all sites not included in the Enterprise Mode Site List to Microsoft Edge
GP name: RestrictInternetExplorer
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

  <policy name="RestrictInternetExplorer" class="Both" displayName="$(string.RestrictInternetExplorer)" explainText="$(string.IE_ExplainRestrictInternetExplorer)" key="Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode" valueName="RestrictIE">

      <parentCategory ref="InternetExplorer" />

      <supportedOn ref="SUPPORTED_IE11WIN10_1607" />

      <enabledValue>

        <decimal value="1" />

      </enabledValue>

      <disabledValue>

        <decimal value="0" />

      </disabledValue>

    </policy>

InternetExplorer/SpecifyUseOfActiveXInstallerService

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to specify how ActiveX controls are installed.

If you enable this policy setting, ActiveX controls are installed only if the ActiveX Installer Service is present and has been configured to allow the installation of ActiveX controls.

If you disable or do not configure this policy setting, ActiveX controls, including per-user controls, are installed through the standard installation process.

ADMX Info:

GP Friendly name: Specify use of ActiveX Installer Service for installation of ActiveX controls
GP name: OnlyUseAXISForActiveXInstall
GP path: Windows Components/Internet Explorer
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowAccessToDataSources

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADMX Info:

GP Friendly name: Access data sources across domains
GP name: IZ_PolicyAccessDataSourcesAcrossDomains_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Notification bar. Users can click on the Notification bar to allow the ActiveX control prompt.

If you do not configure this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

ADMX Info:

GP Friendly name: Automatic prompting for ActiveX controls
GP name: IZ_PolicyNotificationBarActiveXURLaction_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowAutomaticPromptingForFileDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

If you disable or do not configure this setting, users will receive a file download dialog for automatic download attempts.

ADMX Info:

GP Friendly name: Automatic prompting for file downloads
GP name: IZ_PolicyNotificationBarDownloadURLaction_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowFontDownloads

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADMX Info:

GP Friendly name: Allow font downloads
GP name: IZ_PolicyFontDownload_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowLessPrivilegedSites

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether Web sites from less privileged zones, such as Restricted Sites, can navigate into this zone.

If you do not configure this policy setting, a warning is issued to the user that potentially risky navigation is about to occur.

ADMX Info:

GP Friendly name: Web sites in less privileged Web content zones can navigate into this zone
GP name: IZ_PolicyZoneElevationURLaction_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowNETFrameworkReliantComponents

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will execute unsigned managed components.

ADMX Info:

GP Friendly name: Run .NET Framework-reliant components not signed with Authenticode
GP name: IZ_PolicyUnsignedFrameworkComponentsURLaction_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowScriptlets

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage whether the user can run scriptlets.

If you enable this policy setting, the user can run scriptlets.

If you disable this policy setting, the user cannot run scriptlets.

If you do not configure this policy setting, the user can enable or disable scriptlets.

ADMX Info:

GP Friendly name: Allow scriptlets
GP name: IZ_Policy_AllowScriptlets_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowSmartScreenIE

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting controls whether Windows Defender SmartScreen scans pages in this zone for malicious content.

If you enable this policy setting, Windows Defender SmartScreen scans pages in this zone for malicious content.

If you disable this policy setting, Windows Defender SmartScreen does not scan pages in this zone for malicious content.

If you do not configure this policy setting, the user can choose whether Windows Defender SmartScreen scans pages in this zone for malicious content.

Note: In Internet Explorer 7, this policy setting controls whether Phishing Filter scans pages in this zone for malicious content.

ADMX Info:

GP Friendly name: Turn on SmartScreen Filter scan
GP name: IZ_Policy_Phishing_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneAllowUserDataPersistence

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADMX Info:

GP Friendly name: Userdata persistence
GP name: IZ_PolicyUserdataPersistence_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneDoNotRunAntimalwareAgainstActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting determines whether Internet Explorer runs antimalware programs against ActiveX controls, to check if they're safe to load on pages.

If you enable this policy setting, Internet Explorer won't check with your antimalware program to see if it's safe to create an instance of the ActiveX control.

If you disable this policy setting, Internet Explorer always checks with your antimalware program to see if it's safe to create an instance of the ActiveX control.

ADMX Info:

GP Friendly name: Don't run antimalware programs against ActiveX controls
GP name: IZ_PolicyAntiMalwareCheckingOfActiveXControls_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneInitializeAndScriptActiveXControls

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage ActiveX controls not marked as safe.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, users are queried whether to allow the control to be loaded with parameters or scripted.

ADMX Info:

GP Friendly name: Initialize and script ActiveX controls not marked as safe
GP name: IZ_PolicyScriptActiveXNotMarkedSafe_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneJavaPermissions

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, the permission is set to Low Safety.

ADMX Info:

GP Friendly name: Java permissions
GP name: IZ_PolicyJavaPermissions_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

InternetExplorer/TrustedSitesZoneNavigateWindowsAndFrames

Edition	Windows 10	Windows 11
Home	No	No
Pro	Yes	Yes
Business	Yes	Yes
Enterprise	Yes	Yes
Education	Yes	Yes

Scope:

This policy setting allows you to manage the opening of windows and frames and access of applications across different domains.

If you disable this policy setting, users cannot open windows and frames to access applications from different domains.

If you do not configure this policy setting, users can open windows and frames from other domains and access applications from other domains.

ADMX Info:

GP Friendly name: Navigate windows and frames across different domains
GP name: IZ_PolicyNavigateSubframesAcrossDomains_5
GP path: Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone
GP ADMX file name: inetres.admx

516 KiB Raw Blame History Unescape Escape

Policy CSP - InternetExplorer

InternetExplorer policies

516 KiB

Raw Blame History