User Configuration

Location: User Configuration\

Description:
Contains settings that may only be used to configure Users

    ADM File: inetres.adm


Internet Explorer

Location: User Configuration\Windows Components\Internet Explorer

Description:
Contains settings to configure Internet Explorer

  • Search: Disable Search Customization
  • Search: Disable Find Files via F3 within the browser
  • Disable external branding of Internet Explorer
  • Disable importing and exporting of favorites
  • Internet Control Panel
  • Disable changing Advanced page settings
  • Disable changing home page settings
  • Use Automatic Detection for dial-up connections
  • Disable caching of Auto-Proxy scripts
  • Display error message on proxy script download failure
  • Disable changing Temporary Internet files settings
  • Disable changing history settings
  • Disable changing color settings
  • Disable changing link color settings
  • Disable changing font settings
  • Disable changing language settings
  • Disable changing accessibility settings
  • Disable Internet Connection wizard
  • Disable changing connection settings
  • Disable changing proxy settings
  • Disable changing Automatic Configuration settings
  • Turn off pop-up management
  • Pop-up allow list
  • Disable changing ratings settings
  • Disable changing certificate settings
  • Disable changing Profile Assistant settings
  • Disable AutoComplete for forms
  • Do not allow AutoComplete to save passwords
  • Disable changing Messaging settings
  • Disable changing Calendar and Contact settings
  • Disable the Reset Web Settings feature
  • Disable changing default browser check
  • Turn off Crash Detection
  • Do not allow users to enable or disable add-ons
  • Identity Manager: Prevent users from using Identities
  • Configure Outlook Express
  • Offline Pages
  • Browser menus
  • Toolbars
  • Persistence Behavior
  • Administrator Approved Controls
  • Security Features

ADM File: inetres.adm


Search: Disable Search Customization

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Makes the Customize button in the Search Assistant appear dimmed.

The Search Assistant is a tool that appears in the Search bar to help users search the Internet.

If you enable this policy, users cannot change their Search Assistant settings, such as setting default search engines for specific tasks.

If you disable this policy or do not configure it, users can change their settings for the Search Assistant.

This policy is designed to help administrators maintain consistent settings for searching across an organization.

ADM File: inetres.adm


Search: Disable Find Files via F3 within the browser

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Disables using the F3 key to search in Internet Explorer and Windows Explorer.

If you enable this policy, the search functionality of the F3 key is disabled. Users cannot press F3 to search the Internet (from Internet Explorer) or to search the hard disk (from Windows Explorer). If the user presses F3, a prompt appears that informs the user that this feature has been disabled.

If you disable this policy or do not configure it, users can press F3 to search the Internet (from Internet Explorer) or the hard disk (from Windows Explorer).

This policy is intended for situations in which administrators do not want users to explore the Internet or the hard disk.

This policy can be used in coordination with the "File Menu: Disable Open menu option" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Browser Menus), which prevents users from opening files by using the browser.

ADM File: inetres.adm


Disable external branding of Internet Explorer

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents branding of Internet programs, such as customization of Internet Explorer and Outlook Express logos and title bars, by another party.

If you enable this policy, it prevents customization of the browser by another party, such as an Internet service provider or Internet content provider.

If you disable this policy or do not configure it, users could install customizations from another party-for example, when signing up for Internet services.

This policy is intended for administrators who want to maintain a consistent browser across an organization.

ADM File: inetres.adm


Disable importing and exporting of favorites

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from exporting or importing favorite links by using the Import/Export Wizard.

If you enable this policy, the Import/Export Wizard cannot import or export favorite links or cookies, which are small text files that contain settings for Web sites.

If you disable this policy or do not configure it, users can import and export favorites in Internet Explorer by clicking the File menu, clicking Import and Export, and then running the Import/Export Wizard.

Note

  • If you enable this policy, users can still view screens in the wizard, but when users click Finish, a prompt will appear that states that this feature has been disabled.

ADM File: inetres.adm


Internet Control Panel

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel

Description:
Contains settings to add or remove tabs from the Internet Options dialog.

  • Disable the General page
  • Disable the Security page
  • Disable the Content page
  • Disable the Connections page
  • Disable the Programs page
  • Disable the Privacy page
  • Disable the Advanced page
  • Security Page

ADM File: inetres.adm


Disable the General page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the General tab from the interface in the Internet Options dialog box.

If you enable this policy, users are unable to see and change settings for the home page, the cache, history, Web page appearance, and accessibility.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the General tab from the interface:

"Disable changing home page settings"

"Disable changing Temporary Internet files settings"

"Disable changing history settings"

"Disable changing color settings"

"Disable changing link color settings"

"Disable changing font settings"

"Disable changing language settings"

"Disable changing accessibility settings"

ADM File: inetres.adm


Disable the Security page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Security tab from the interface in the Internet Options dialog box.

If you enable this policy, it prevents users from seeing and changing settings for security zones, such as scripting, downloads, and user authentication.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies, because this policy removes the Security tab from the interface:

"Security zones: Do not allow users to change policies"

"Security zones: Do not allow users to add/delete sites"

ADM File: inetres.adm


Disable the Content page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Content tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Profile Assistant settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Content tab from the interface:

"Disable changing ratings settings"

"Disable changing certificate settings"

"Disable changing Profile Assistant settings"

"Disable AutoComplete for forms"

"Do not allow AutoComplete to save passwords"

ADM File: inetres.adm


Disable the Connections page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Connections tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing connection and proxy settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Connections tab from the interface:

"Disable Internet Connection Wizard"

"Disable changing connection settings"

"Disable changing proxy settings"

"Disable changing Automatic Configuration settings"

ADM File: inetres.adm


Disable the Programs page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Programs tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for Internet programs.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Programs tab, because this policy removes the Programs tab from the interface:

"Disable changing Messaging settings"

"Disable changing Calendar and Contact settings"

"Disable the Reset Web Settings feature"

"Disable changing default browser check"

ADM File: inetres.adm


Disable the Privacy page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Privacy tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for privacy.

If you disable this policy or do not configure it, users can see and change these settings.

ADM File: inetres.adm


Disable the Advanced page

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Advanced tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing advanced Internet settings, such as security, multimedia, and printing.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the "Disable changing Advanced page settings" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the Advanced tab from the interface.

ADM File: inetres.adm


Security Page

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page

Description:
If you enable any policies for the security page, it is strongly recommended that you also configure policy to disable the security page from being presented in the UI to prevent users from believing that they can change their security settings.

You can disable the security page using the policy located at Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\.

  • Locked-Down Internet Zone
  • Locked-Down Intranet Zone
  • Locked-Down Trusted Sites Zone
  • Locked-Down Restricted Sites Zone
  • Locked-Down Local Machine Zone
  • Site to Zone Assignment List
  • Intranet Sites: Include all local (intranet) sites not listed in other zones
  • Intranet Sites: Include all sites that bypass the proxy server
  • Intranet Sites: Include all network paths (UNCs)
  • Internet Zone Template
  • Intranet Zone Template
  • Trusted Sites Zone Template
  • Restricted Sites Zone Template
  • Local Machine Zone Template
  • Locked-Down Local Machine Zone Template
  • Locked-Down Internet Zone Template
  • Locked-Down Intranet Zone Template
  • Locked-Down Trusted Sites Zone Template
  • Locked-Down Restricted Sites Zone Template

ADM File: inetres.adm


Run .NET Framework-reliant components signed with Authenticode

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.

If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.

If you disable this policy setting, Internet Explorer will not execute signed managed components.

If you do not configure this policy setting, Internet Explorer will not execute signed managed components.

ADM File: inetres.adm


Run .NET Framework-reliant components not signed with Authenticode

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.

If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADM File: inetres.adm


Download signed ActiveX controls

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.

If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.

If you disable the policy setting, signed controls cannot be downloaded.

If you do not configure this policy setting, users can download signed controls without user intervention.

ADM File: inetres.adm


Download unsigned ActiveX controls

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.

If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.

If you disable this policy setting, users cannot run unsigned controls.

If you do not configure this policy setting, users cannot run unsigned controls.

ADM File: inetres.adm


Initialize and script ActiveX controls not marked as safe

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADM File: inetres.adm


Run ActiveX controls and plugins

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the Local Machine zone.

If you enable this policy setting, controls and plug-ins can run without user intervention.

If you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.

If you disable this policy setting, controls and plug-ins are prevented from running.

If you do not configure this policy setting, controls and plug-ins are prevented from running.

ADM File: inetres.adm


Script ActiveX controls marked safe for scripting

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.

If you enable this policy setting, script interaction can occur automatically without user intervention.

If you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.

If you disable this policy setting, script interaction is prevented from occurring.

If you do not configure this policy setting, script interaction can occur automatically without user intervention.

ADM File: inetres.adm


Allow file downloads

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether file downloads are permitted from the Local Machine zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.

If you enable this policy setting, files can be downloaded from the zone.

If you disable this policy setting, files are prevented from being downloaded from the zone.

If you do not configure this policy setting, files can be downloaded from the zone.

ADM File: inetres.adm


Allow font downloads

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADM File: inetres.adm


Java permissions

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADM File: inetres.adm


Access data sources across domains

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADM File: inetres.adm


Allow active content over restricted protocols to access my computer

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone\

Description:
This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Local Machine Zone can run active content such as script, ActiveX, Java and Binary Behaviors. The list of restricted protocols may be set in the Local Machine Zone Restricted Protocols section under Network Protocol Lockdown policy.

If you enable this policy setting, no Local Machine Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.

If you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.

If you do not configure this policy setting, no content is restricted unless the Network Protocol Lockdown security feature is enabled.

ADM File: inetres.adm


Automatic prompting for file downloads

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.

ADM File: inetres.adm


Automatic prompting for ActiveX controls

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.

If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations using the Information Bar.

ADM File: inetres.adm


Allow META REFRESH

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page.

If you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting, can be redirected to another Web page.

If you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting, cannot be redirected to another Web page.

If you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting, can be redirected to another Web page.

ADM File: inetres.adm


Allow script-initiated windows without size or position constraints

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.

If you enable this policy setting, Windows Restrictions security will not apply in the Local Machine zone. The security zone runs without the added layer of security provided by this feature.

If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in the Local Machine zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in the Local Machine zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

ADM File: inetres.adm


Allow binary and script behaviors

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.

If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.

If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.

If you do not configure this policy setting, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.

ADM File: inetres.adm


Display mixed content

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.

If you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.

If the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.

If you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.

If you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.

ADM File: inetres.adm


Do not prompt for client certificate selection when no certificates or only one certificate exists.

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.

If you enable this policy setting, Internet Explorer does not prompt users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate.

If you disable this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate.

If you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate.

ADM File: inetres.adm


Allow drag and drop or copy and paste files

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the Local Machine zone.

If you enable this policy setting, users can drag files or copy and paste files from the Local Machine zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from the Local Machine zone.

If you disable this policy setting, users are prevented from dragging files or copying and pasting files from the Local Machine zone.

If you do not configure this policy setting, users can drag files or copy and paste files from the Local machine zone automatically.

ADM File: inetres.adm


Allow installation of desktop items

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users can install Active Desktop items from the Local Machine zone. The settings for this option are: If you enable this policy setting, users can install desktop items from the Local Machine zone automatically.

If you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from the Local Machine zone.

If you disable this policy setting, users are prevented from installing desktop items from the Local Machine zone.

If you do not configure this policy setting, users can install desktop items from the Local Machine zone automatically.

ADM File: inetres.adm


Launching applications and files in an IFRAME

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.

If you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.

If you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

If you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention.

ADM File: inetres.adm


Navigate sub-frames across different domains

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.

If you enable this policy setting, users can open additional sub-frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional sub-frames or access to applications from other domains.

If you disable this policy setting, users cannot open other sub-frames or access applications from different domains.

If you do not configure this policy setting, users can open additional sub-frames from other domains and access applications from other domains.

ADM File: inetres.adm


Open files based on content, not file extension

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.

If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in the Local Machine zone. The security zone will run without the added layer of security provided by this feature.

If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in the Local Machine zone, as dictated by the feature control setting for the process.

If you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in the Local Machine zone, as dictated by the feature control setting for the process.

ADM File: inetres.adm


Software channel permissions

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage software channel permissions.

If you enable this policy setting, you can choose the following options from the drop-down box.

Low safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.

Medium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.

High safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.

If you disable this policy setting, permissions are set to high safety.

If you do not configure this policy setting, permissions are set to Low safety.

ADM File: inetres.adm


Submit non-encrypted form data

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether data on HTML forms on pages in the Local Machine zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.

If you enable this policy setting, information using HTML forms on pages in the Local Machine zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in the Local Machine zone to be submitted.

If you disable this policy setting, information using HTML forms on pages in the Local Machine zone is prevented from being submitted.

If you do not configure this policy setting, information using HTML forms on pages in the Local Machine zone can be submitted automatically.

ADM File: inetres.adm


Use Pop-up Blocker

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.

If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.

If you disable this policy setting, pop-up windows are not prevented from appearing.

If you do not configure this policy setting, pop-up windows are not prevented from appearing.

ADM File: inetres.adm


Userdata persistence

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADM File: inetres.adm


Web sites in less privileged Web content zones can navigate into this zone

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate to the Local Machine zone.

If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, the Local Machine zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.

If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in the Local Machine zone as set by Protection from Zone Elevation feature control.

If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in the Local Machine zone as set by Protection from Zone Elevation feature control.

ADM File: inetres.adm


Allow active scripting

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether script code on pages in the Local Machine zone is run.

If you enable this policy setting, script code on pages in the Local Machine zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the Local Machine zone to run.

If you disable this policy setting, script code on pages in the Local Machine zone is prevented from running.

If you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run.

ADM File: inetres.adm


Allow paste operations via script

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.

If you enable this policy setting, a script can perform a clipboard operation.

If you disable this policy, a script cannot perform a clipboard operation.

If you do not configure this policy setting, a script can perform a clipboard operation.

ADM File: inetres.adm


Scripting of Java applets

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether applets are exposed to scripts within the zone.

If you enable this policy setting, scripts can access applets automatically without user intervention.

If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.

If you disable this policy setting, scripts are prevented from accessing applets.

If you do not configure this policy setting, scripts can access applets automatically without user intervention.

ADM File: inetres.adm


Logon options

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage settings for logon options.

If you enable this policy setting, you can choose from the following logon options:

Anonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.

Prompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.

If you disable this policy setting, logon is set to Automatic logon only in Intranet zone.

If you do not configure this policy setting, logon is set to Automatic logon with current username and password.

ADM File: inetres.adm


Locked-Down Internet Zone

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone

Description:
The settings in this zone apply only if the Internet Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Internet Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Intranet Zone

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone

Description:
The settings in this zone apply only if the Intranet Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Intranet Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Trusted Sites Zone

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone

Description:
The settings in this zone apply only if the Trusted Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Trusted Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Restricted Sites Zone

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone

Description:
The settings in this zone apply only if the Restricted Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Restricted Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the relevant behavior is strictly blocked, preventing the zone from operating with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Local Machine Zone

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone

Description:
The settings in this zone apply only if the Local Machine Zone is in 'lockdown' mode, such as when the Local Machine Zone Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Local Machine Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Site to Zone Assignment List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.

Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)

If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:

Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.

Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.

If you disable this policy setting, any such list is deleted and no site-to-zone assignments are permitted.

If this policy is not configured, users may choose their own site-to-zone assignments.

ADM File: inetres.adm


Intranet Sites: Include all local (intranet) sites not listed in other zones

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.

If you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.

If you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).

If you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone.

ADM File: inetres.adm


Intranet Sites: Include all sites that bypass the proxy server

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.

If you enable this policy setting, sites which bypass the proxy server are mapped into the Intranet Zone.

If you disable this policy setting, sites which bypass the proxy server aren't necessarily mapped into the Intranet Zone (other rules might map one there).

If you do not configure this policy setting, users choose whether sites which bypass the proxy server are mapped into the Intranet Zone.

ADM File: inetres.adm


Intranet Sites: Include all network paths (UNCs)

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.

If you enable this policy setting, all network paths are mapped into the Intranet Zone.

If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).

If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.

ADM File: inetres.adm


Internet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Intranet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Trusted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Restricted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Local Machine Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Local Machine Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Internet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Intranet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Trusted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Restricted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Automatically check for Internet Explorer updates

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manager whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available.

If you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available.

If you disable this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them.

If you do not configure this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them.

ADM File: inetres.adm


Enable Install On Demand (Internet Explorer)

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users can automatically download and install Web components (such as fonts) that can installed by Internet Explorer Active Setup. For example, if you open a Web page that requires Japanese-text display support, Internet Explorer could prompt the user to download the Japanese Language Pack component if it is not already installed.

If you enable this policy setting, Web components such as fonts will be automatically installed as necessary.

If you disable this policy setting, users will be prompted when Web Components such as fonts would be downloaded.

If you do not configure this policy, users will be prompted when Web Components such as fonts would be downloaded.

ADM File: inetres.adm


Enable Install On Demand (Other)

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users can download and install self-installing program files (non-Internet Explorer components) that are registered with Internet Explorer (such as Windows Media Player, Macromedia, and Java) that are required in order to view web pages as intended.

If you enable this policy setting, non-Internet Explorer components will be automatically installed as necessary.

If you disable this policy setting, users will be prompted when non-Internet Explorer components would be installed.

If you do not configure this policy setting, non-Internet Explorer components will be automatically installed as necessary.

ADM File: inetres.adm


Enable third-party browser extensions

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users can download add-ons known as browser helper objects (BHOs), such as toolbars. BHOs may contain flaws such as buffer overruns which impact Internet Explorer’s performance or stability.

If you enable this policy setting, users can download and launch browser helper objects.

If you disable this policy setting, users are blocked from downloading or launching browser helper objects.

If you do not configure this policy, users can download and launch browser helper objects.

ADM File: inetres.adm


Play animations in web pages

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will display animated pictures found in Web content. Generally only animated GIF files are affected by this setting; active Web content such as java applets are not.

If you enable this policy setting, Internet Explorer will play animated pictures found in Web content.

If you disable this policy setting, Internet Explorer will not play or download animated pictures, helping pages display more quickly.

If you do not configure this policy setting, Internet Explorer will play animated pictures found in Web content.

ADM File: inetres.adm


Play sounds in web pages

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will play sounds found in web content. Generally only sound files such as MIDI files are affected by this setting; active Web content such as java applets are not.

If you enable this policy setting, Internet Explorer will play sounds found in Web content.

If you disable this policy setting, Internet Explorer will not play or download sounds in Web content, helping pages display more quickly.

If you enable this policy setting, Internet Explorer will play sounds found in Web content.

ADM File: inetres.adm


Play videos in web pages

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will display videos found in Web content. Generally only video files such as MIDI files are affected by this setting; active Web content such as java applets are not.

If you enable this policy setting, Internet Explorer will play videos found in Web content.

If you disable this policy setting, Internet Explorer will not play or download videos, helping pages display more quickly.

If you do not configure this policy setting, Internet Explorer will play videos found in Web content.

ADM File: inetres.adm


Allow active content from CDs to run on user machines

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.

If you enable this policy setting, active content on a CD will run without a prompt.

If you disable this policy setting, active content on a CD will always prompt before running.

If you do not configure this policy, users can choose whether to be prompted before running active content on a CD.

ADM File: inetres.adm


Allow software to run or install even if the signature is invalid

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file.

If you enable this policy setting, users will be prompted to install or run files with an invalid signature.

If you disable this policy setting, users cannot run or install files with an invalid signature.

If you do not configure this policy, users can choose to run or install files with an invalid signature.

ADM File: inetres.adm


Check for server certificate revocation

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.

If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.

If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

ADM File: inetres.adm


Check for signatures on downloaded programs

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.

If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.

If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

ADM File: inetres.adm


Do not save encrypted pages to disk

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will save encrypted pages that contain secure (HTTPS) information such as passwords and credit card numbers to a disk, which may be insecure.

If you enable this policy setting, Internet Explorer will not save encrypted pages containing secure (HTTPS) information to the user's disk.

If you disable this policy setting, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the user's disk.

If you do not configure this policy, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the user's disk

ADM File: inetres.adm


Empty Temporary Internet Files folder when browser is closed

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: User Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer deletes the contents of the Temporary Internet Files folder after all browser windows are closed. This protects against storing dangerous files on the computer, or storing sensitive files that other users could see, in addition to managing total disk space usage.

If you enable this policy setting, Internet Explorer will delete the contents of the user's Temporary Internet Files folder when all browser windows are closed.

If you disable this policy setting, Internet Explorer will not delete the contents of the user's Temporary Internet Files folder when browser windows are closed.

If you do not configure this policy, Internet Explorer will not delete the contents of the Temporary Internet Files folder when browser windows are closed.

ADM File: inetres.adm


Disable changing Advanced page settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing settings on the Advanced tab in the Internet Options dialog box.

If you enable this policy, users are prevented from changing advanced Internet settings, such as security, multimedia, and printing. Users cannot select or clear the check boxes on the Advanced tab.

If you disable this policy or do not configure it, users can select or clear settings on the Advanced tab.

If you set the "Disable the Advanced page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the Advanced page" policy removes the Advanced tab from the interface.

ADM File: inetres.adm


Disable changing home page settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the home page of the browser. The home page is the first page that appears when users start the browser.

If you enable this policy, the settings in the Home Page area on the General tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change their home page.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

This policy is intended for administrators who want to maintain a consistent home page across their organization.

ADM File: inetres.adm


Use Automatic Detection for dial-up connections

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Specifies that Automatic Detection will be used to configure dial-up settings for users.

Automatic Detection uses a DHCP (Dynamic Host Configuration Protocol) or DNS server to customize the browser the first time it is started.

If you enable this policy, users' dial-up settings will be configured by Automatic Detection.

If you disable this policy or do not configure it, dial-up settings will not be configured by Automatic Detection, unless specified by the user.

ADM File: inetres.adm


Disable caching of Auto-Proxy scripts

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents automatic proxy scripts, which interact with a server to automatically configure users' proxy settings, from being stored in the users' cache.

If you enable this policy, automatic proxy scripts will not be stored temporarily on the users' computer.

If you disable this policy or do not configure it, automatic proxy scripts can be stored in the users' cache.

ADM File: inetres.adm


Display error message on proxy script download failure

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Specifies that error messages will be displayed to users if problems occur with proxy scripts.

If you enable this policy, error messages will be displayed when the browser does not download or run a script to set proxy settings.

If you disable this policy or do not configure it, error messages will not be displayed when problems occur with proxy scripts.

ADM File: inetres.adm


Disable changing Temporary Internet files settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the browser cache settings, such as the location and amount of disk space to use for the Temporary Internet Files folder.

If you enable this policy, the browser cache settings appear dimmed. These settings are found in the dialog box that appears when users click the General tab and then click the Settings button in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change their cache settings.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

ADM File: inetres.adm


Disable changing history settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the history settings for the browser.

If you enable this policy, the settings in the History area on the General tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change the number of days to store Web page information and clear Web page history.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

ADM File: inetres.adm


Disable changing color settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the default Web page colors.

If you enable this policy, the color settings for Web pages appear dimmed. The settings are located in the Colors area in the dialog box that appears when the user clicks the General tab and then clicks the Colors button in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change the default background and text color of Web pages.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

Note

  • The default Web page colors are ignored on Web pages in which the author has specified the background and text colors.

ADM File: inetres.adm


Disable changing link color settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the colors of links on Web pages.

If you enable this policy, the color settings for links appear dimmed. The settings are located in the Links area of the dialog box that appears when users click the General tab and then click the Colors button in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change the default color of links on Web pages.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

Note

  • The default link colors are ignored on Web pages on which the author has specified link colors.

ADM File: inetres.adm


Disable changing font settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing font settings.

If you enable this policy, the Font button on the General tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change the default fonts for viewing Web pages.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

Note

  • The default font settings colors are ignored in cases in which the Web page author has specified the font attributes.

ADM File: inetres.adm


Disable changing language settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing language settings.

If you enable this policy, the Languages button on the General tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change the language settings for viewing Web sites for languages in which the character set has been installed.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

ADM File: inetres.adm


Disable changing accessibility settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing accessibility settings.

If you enable this policy, the Accessibility button on the General tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change accessibility settings, such as overriding fonts and colors on Web pages.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

ADM File: inetres.adm


Disable Internet Connection wizard

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from running the Internet Connection Wizard.

If you enable this policy, the Setup button on the Connections tab in the Internet Options dialog box appears dimmed.

Users will also be prevented from running the wizard by clicking the Connect to the Internet icon on the desktop or by clicking Start, pointing to Programs, pointing to Accessories, pointing to Communications, and then clicking Internet Connection Wizard.

If you disable this policy or do not configure it, users can change their connection settings by running the Internet Connection Wizard.

Note

  • This policy overlaps with the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Connections tab from the interface. Removing the Connections tab from the interface, however, does not prevent users from running the Internet Connection Wizard from the desktop or the Start menu.

ADM File: inetres.adm


Disable changing connection settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing dial-up settings.

If you enable this policy, the Settings button on the Connections tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can change their settings for dial-up connections.

If you set the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the Connections page" policy removes the Connections tab from the interface.

ADM File: inetres.adm


Disable changing proxy settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing proxy settings.

If you enable this policy, the proxy settings appear dimmed. These settings are in the Proxy Server area of the Local Area Network (LAN) Settings dialog box, which appears when the user clicks the Connections tab and then clicks the LAN Settings button in the Internet Options dialog box.

If you set the "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the Connections page" policy removes the Connections tab from the interface.

ADM File: inetres.adm


Disable changing Automatic Configuration settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing automatic configuration settings. Automatic configuration is a process that administrators can use to update browser settings periodically.

If you enable this policy, the automatic configuration settings appear dimmed. The settings are located in the Automatic Configuration area of the Local Area Network (LAN) Settings dialog box. To see the Local Area Network (LAN) Settings dialog box, users open the Internet Options dialog box, click the Connections tab, and then click the LAN Settings button.

If you disable this policy or do not configure it, the user can change automatic configuration settings.

This policy is intended to enable administrators to ensure that users' settings are updated uniformly through automatic configuration.

The "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Connections tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Turn off pop-up management

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\

Description:
This policy setting allows you to manage pop-up management functionality in Internet Explorer.

If you enable this policy setting, the Control Panel information relating to pop-up management will be unavailable (grayed out) and all other pop-up manager controls, notifications, and dialog boxes will not appear. Pop-up windows will continue to function as they did in Windows XP Service Pack 1 or earlier, although windows launched off screen will continue to be re-positioned onscreen.

If you disable or do not configure this policy setting, the popup management feature will be functional.

ADM File: inetres.adm


Pop-up allow list

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Pop-up allow list

ADM File: inetres.adm


Disable changing ratings settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing ratings that help control the type of Internet content that can be viewed.

If you enable this policy, the settings in the Content Advisor area on the Content tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change their ratings settings.

The "Disable the Ratings page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Ratings tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable changing certificate settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing certificate settings in Internet Explorer. Certificates are used to verify the identity of software publishers.

If you enable this policy, the settings in the Certificates area on the Content tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can import new certificates, remove approved publishers, and change settings for certificates that have already been accepted.

The "Disable the Content page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

Caution

  • If you enable this policy, users can still run the Certificate Manager Import Wizard by double-clicking a software publishing certificate (.spc) file. This wizard enables users to import and configure settings for certificates from software publishers that haven't already been configured for Internet Explorer.

ADM File: inetres.adm


Disable changing Profile Assistant settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing Profile Assistant settings.

If you enable this policy, the My Profile button appears dimmed in the Personal Information area on the Content tab in the Internet Options dialog box.

If you disable this policy or do not configure it, users can change their profile information, such as their street and e-mail addresses.

The "Disable the Connections page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Connections tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable AutoComplete for forms

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents Microsoft Internet Explorer from automatically completing forms, such as filling in a name or a password that the user has entered previously on a Web page.

If you enable this policy, the Forms check box appears dimmed. To display the Forms check box, users open the Internet Options dialog box, click the Content tab, and then click the AutoComplete button.

If you disable this policy or do not configure it, users can enable the automatic completion of forms.

The "Disable the Content page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

Caution

  • If you enable this policy after users have used their browser with form automatic completion enabled, it will not clear the automatic completion history for forms that users have already filled out.

ADM File: inetres.adm


Do not allow AutoComplete to save passwords

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Disables automatic completion of user names and passwords in forms on Web pages, and prevents users from being prompted to save passwords.

If you enable this policy, the User Names and Passwords on Forms and Prompt Me to Save Passwords check boxes appear dimmed. To display these check boxes, users open the Internet Options dialog box, click the Content tab, and then click the AutoComplete button.

If you disable this policy or don't configure it, users can determine whether Internet Explorer automatically completes user names and passwords on forms and prompts them to save passwords.

The "Disable the Content page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Content tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable changing Messaging settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the default programs for messaging tasks.

If you enable this policy, the E-mail, Newsgroups, and Internet Call options in the Internet Programs area appear dimmed. To display these options, users open the Internet Options dialog box, and then click the Programs tab.

If you disable this policy or do not configure it, users can determine which programs to use for sending mail, viewing newsgroups, and placing Internet calls, if programs that perform these tasks are installed.

The "Disable the Programs page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Programs tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable changing Calendar and Contact settings

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing the default programs for managing schedules and contacts.

If you enable this policy, the Calendar and Contact check boxes appear dimmed in the Internet Programs area. To display these options, users open the Internet Options dialog box, and then click the Programs tab.

If you disable this policy or do not configure it, users can determine which programs to use for managing schedules and contacts, if programs that perform these tasks are installed.

This "Disable the Programs Page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel) takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable the Reset Web Settings feature

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from restoring default settings for home and search pages.

If you enable this policy, the Reset Web Settings button on the Programs tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can restore the default settings for home and search pages.

The "Disable the Programs page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Programs tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable changing default browser check

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents Microsoft Internet Explorer from checking to see whether it is the default browser.

If you enable this policy, the Internet Explorer Should Check to See Whether It Is the Default Browser check box on the Programs tab in the Internet Options dialog box appears dimmed.

If you disable this policy or do not configure it, users can determine whether Internet Explorer will check to see if it is the default browser. When Internet Explorer performs this check, it prompts the user to specify which browser to use as the default.

This policy is intended for organizations that do not want users to determine which browser should be their default.

The "Disable the Programs page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Programs tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Turn off Crash Detection

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\

Description:
This policy setting allows you to manage the crash detection feature of add-on Management.

If you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply.

If you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional.

ADM File: inetres.adm


Do not allow users to enable or disable add-ons

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\

Description:
This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager.

If you enable this policy setting, users cannot enable or disable add-ons through Add-On Manager. The only exception occurs if an add-on has been specifically entered into the 'Add-On List' policy setting in such a way as to allow users to continue to manage the add-on. In this case, the user can still manage the add-on through the Add-On Manager.

If you disable or do not configure this policy setting, the appropriate controls in the Add-On Manager will be available to the user.

ADM File: inetres.adm


Identity Manager: Prevent users from using Identities

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from configuring unique identities by using Identity Manager.

Identity Manager enables users to create multiple accounts, such as e-mail accounts, on the same computer. Each user has a unique identity, with a different password and different program preferences.

If you enable this policy, users will not be able to create new identities, manage existing identities, or switch identities. The Switch Identity option will be removed from the File menu in Address Book.

If you disable this policy or do not configure it, users can set up and change identities.

ADM File: inetres.adm


Configure Outlook Express

Requirements: at least Internet Explorer v6.0

Location: User Configuration\Windows Components\Internet Explorer\

Description:
Allows Administrators to enable and disable the ability for Outlook Express users to save or open attachments that can potentially contain a virus.

If you check the block attachments setting, users will be unable to open or save attachments that could potentially contain a virus. Users will not be able to disable the blocking of attachments in options.

If the block attachments setting is not checked, the user can specify to enable or disable the blocking of attachments in options.

ADM File: inetres.adm


Offline Pages

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages

Description:
Contains settings for Offline pages and channels.

  • Disable adding channels
  • Disable removing channels
  • Disable adding schedules for offline pages
  • Disable editing schedules for offline pages
  • Disable removing schedules for offline pages
  • Disable offline page hit logging
  • Disable all scheduled offline pages
  • Disable channel user interface completely
  • Disable downloading of site subscription content
  • Disable editing and creating of schedule groups
  • Subscription Limits

ADM File: inetres.adm


Disable adding channels

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from adding channels to Internet Explorer.

Channels are Web sites that are updated automatically on your computer, according to a schedule specified by the channel provider.

If you enable this policy, the Add Active Channel button, which appears on a channel that users haven't yet subscribed to, will be disabled. Users also cannot add content that is based on a channel, such as some of the Active Desktop items from Microsoft's Active Desktop Gallery, to their desktop.

If you disable this policy or do not configure it, users can add channels to the Channel bar or to their desktop.

Note

  • Most channel providers use the words Add Active Channel for this option; however, a few use different words, such as Subscribe.

ADM File: inetres.adm


Disable removing channels

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from disabling channel synchronization in Microsoft Internet Explorer.

Channels are Web sites that are automatically updated on your computer according to a schedule specified by the channel provider.

If you enable this policy, users cannot prevent channels from being synchronized.

If you disable this policy or do not configure it, users can disable the synchronization of channels.

This policy is intended to help administrators ensure that users' computers are being updated uniformly across their organization.

Note

  • This policy does not prevent users from removing active content from the desktop interface.

ADM File: inetres.adm


Disable adding schedules for offline pages

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from specifying that Web pages can be downloaded for viewing offline. When users make Web pages available for offline viewing, they can view the content when their computer is not connected to the Internet.

If you enable this policy, users cannot add new schedules for downloading offline content. The Make Available Offline check box will be dimmed in the Add Favorite dialog box.

If you disable this policy or do not configure it, users can add new offline content schedules.

This policy is intended for organizations that are concerned about server load for downloading content.

The "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable editing schedules for offline pages

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from editing an existing schedule for downloading Web pages for offline viewing.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, users cannot display the schedule properties of pages that have been set up for offline viewing. If users click the Tools menu, click Synchronize, select a Web page, and then click the Properties button, no properties are displayed. Users do not receive an alert stating that the command is unavailable.

If you disable this policy or do not configure it, users can edit an existing schedule for downloading Web content for offline viewing.

This policy is intended for organizations that are concerned about server load for downloading content.

The "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable removing schedules for offline pages

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from clearing the preconfigured settings for Web pages to be downloaded for offline viewing.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, the Make Available Offline check box in the Organize Favorites Favorite dialog box and the Make This Page Available Offline check box will be selected but dimmed. To display the Make This Page Available Offline check box, users click the Tools menu, click Synchronize, and then click the Properties button.

If you disable this policy or do not configure it, users can remove the preconfigured settings for pages to be downloaded for offline viewing.

This policy is intended for organizations that are concerned about server load for downloading content.

The "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable offline page hit logging

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents channel providers from recording information about when their channel pages are viewed by users who are working offline.

If you enable this policy, it disables any channel logging settings set by channel providers in the channel definition format (.cdf) file. The .cdf file determines the schedule and other settings for downloading Web content.

If you disable this policy or do not configure it, channel providers can record information about when their channel pages are viewed by users who are working offline.

ADM File: inetres.adm


Disable all scheduled offline pages

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Disables existing schedules for downloading Web pages for offline viewing.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, the check boxes for schedules on the Schedule tab of the Web page properties are cleared and users cannot select them. To display this tab, users click the Tools menu, click Synchronize, select a Web page, click the Properties button, and then click the Schedule tab.

If you disable this policy, then Web pages can be updated on the schedules specified on the Schedule tab.

This policy is intended for organizations that are concerned about server load for downloading content.

The "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


Disable channel user interface completely

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from viewing the Channel bar interface. Channels are Web sites that are automatically updated on their computer according to a schedule specified by the channel provider.

If you enable this policy, the Channel bar interface will be disabled, and users cannot select the Internet Explorer Channel Bar check box on the Web tab in the Display Properties dialog box.

If you disable this policy or do not configure it, users can view and subscribe to channels from the Channel bar interface.

ADM File: inetres.adm


Disable downloading of site subscription content

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents content from being downloaded from Web sites that users have subscribed to.

When users make Web pages available for offline viewing, they can view content when their computer is not connected to the Internet.

If you enable this policy, content will not be downloaded from Web sites that users have subscribed to. However, synchronization with the Web pages will still occur to determine if any content has been updated since the last time the user synchronized with or visited the page.

If you disable this policy or do not configure it, content will not be prevented from being downloaded.

The "Disable downloading of site subscription content" policy and the "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) take precedence over this policy. If either policy is enabled, this policy is ignored.

ADM File: inetres.adm


Disable editing and creating of schedule groups

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Prevents users from adding, editing, or removing schedules for offline viewing of Web pages and groups of Web pages that users have subscribed to.

A subscription group is a favorite Web page plus the Web pages it links to.

If you enable this policy, the Add, Remove, and Edit buttons on the Schedule tab in the Web page Properties dialog box are dimmed. To display this tab, users click the Tools menu, click Synchronize, select a Web page, click the Properties button, and then click the Schedule tab.

If you disable this policy or do not configure it, users can add, remove, and edit schedules for Web sites and groups of Web sites.

The "Disable editing schedules for offline pages" policy and the "Hide Favorites menu" policy (located in User Configuration\Administrative Templates\Windows Components\Internet Explorer) take precedence over this policy. If either policy is enabled, this policy is ignored.

ADM File: inetres.adm


Subscription Limits

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Offline Pages\

Description:
Restricts the amount of information downloaded for offline viewing.

If you enable this policy, you can set limits to the size and number of pages that users can download. If users attempt to exceed the number of subscriptions, a prompt will appear that states that they cannot set up more Web sites for offline viewing.

If you disable this policy or do not configure it, then users can determine the amount of content that is searched for new information and downloaded.

Caution

  • Although the Maximum Number of Offline Pages option determines how many levels of a Web site are searched for new information, it does not change the user interface in the Offline Favorites wizard.

Note

  • The begin and end times for downloading are measured in minutes after midnight. The Maximum Offline Page Crawl Depth setting specifies how many levels of a Web site are searched for new information.

ADM File: inetres.adm


Browser menus

Location: User Configuration\Windows Components\Internet Explorer\Browser menus

Description:
Contains settings for showing or hiding menus and menu options in Internet Explorer.

  • File menu: Disable Save As... menu option
  • File menu: Disable New menu option
  • File menu: Disable Open menu option
  • File menu: Disable Save As Web Page Complete
  • File menu: Disable closing the browser and Explorer windows
  • View menu: Disable Source menu option
  • View menu: Disable Full Screen menu option
  • Hide Favorites menu
  • Tools menu: Disable Internet Options... menu option
  • Help menu: Remove 'Tip of the Day' menu option
  • Help menu: Remove 'For Netscape Users' menu option
  • Help menu: Remove 'Tour' menu option
  • Help menu: Remove 'Send Feedback' menu option
  • Disable Context menu
  • Disable Open in New Window menu option
  • Disable Save this program to disk option

ADM File: inetres.adm


File menu: Disable Save As... menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from saving Web pages from the browser File menu to their hard disk or to a network share.

If you enable this policy, the Save As command on the File menu will be removed.

If you disable this policy or do not configure it, users can save Web pages for later viewing.

This policy takes precedence over the "File Menu: Disable Save As Web Page Complete" policy, which prevents users from saving the entire contents that are displayed or run from a Web Page, such as graphics, scripts, and linked files, but does not prevent users from saving the text of a Web page.

Caution

  • If you enable this policy, users are not prevented from saving Web content by pointing to a link on a Web page, clicking the right mouse button, and then clicking Save Target As.

ADM File: inetres.adm


File menu: Disable New menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from opening a new browser window from the File menu.

If this policy is enabled, users cannot open a new browser window by clicking the File menu, pointing to the New menu, and then clicking Window. The user interface is not changed, but a new window will not be opened, and users will be informed that the command is not available.

If you disable this policy or do not configure it, users can open a new browser window from the File menu.

Caution

  • This policy does not prevent users from opening a new browser window by right-clicking, and then clicking the Open in New Window command. To prevent users from using the shortcut menu to open new browser windows, you should also set the "Disable Open in New Window menu option" policy, which disables this command on the shortcut menu, or the "Disable context menu" policy, which disables the entire shortcut menu.

ADM File: inetres.adm


File menu: Disable Open menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from opening a file or Web page from the File menu in Internet Explorer.

If you enable this policy, the Open dialog box will not appear when users click the Open command on the File menu. If users click the Open command, they will be notified that the command is not available.

If you disable this policy or do not configure it, users can open a Web page from the browser File menu.

Caution

  • This policy does not prevent users from right-clicking a link on a Web page, and then clicking the Open or Open in New Window command. To prevent users from opening Web pages by using the shortcut menu, set the "Disable Open in New Window menu option" policy, which disables this command on the shortcut menu, or the "Disable context menu" policy, which disables the entire shortcut menu.

ADM File: inetres.adm


File menu: Disable Save As Web Page Complete

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from saving the complete contents that are displayed on or run from a Web page, including the graphics, scripts, linked files, and other elements. It does not prevent users from saving the text of a Web page.

If you enable this policy, the Web Page, Complete file type option will be removed from the Save as Type box in the Save Web Page dialog box. Users can still save Web pages as hypertext markup language (HTML) files or as text files, but graphics, scripts, and other elements are not saved. To display the Save Web Page dialog box, users click the File menu, and then click the Save As command.

If you disable this policy or do not configure it, users can save all elements on a Web page.

The "File menu: Disable Save As... menu option" policy, which removes the Save As command, takes precedence over this policy. If it is enabled, this policy is ignored.

ADM File: inetres.adm


File menu: Disable closing the browser and Explorer windows

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from closing Microsoft Internet Explorer and Windows Explorer.

If you enable this policy, the Close command on the File menu will appear dimmed.

If you disable this policy or do not configure it, users are not prevented from closing the browser or Windows Explorer.

Note

  • The Close button in the top right corner of the program will not work; if users click the Close button, they will be informed that the command is not available.

ADM File: inetres.adm


View menu: Disable Source menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from viewing the HTML source of Web pages by clicking the Source command on the View menu.

If you enable this policy, the Source command on the View menu will appear dimmed.

If you disable this policy or do not configure it, then users can view the HTML source of Web pages from the browser View menu.

Caution

  • This policy does not prevent users from viewing the HTML source of a Web page by right-clicking a Web page to open the shortcut menu, and then clicking View Source. To prevent users from viewing the HTML source of a Web page from the shortcut menu, set the "Disable context menu" policy, which disables the entire shortcut menu.

ADM File: inetres.adm


View menu: Disable Full Screen menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from displaying the browser in full-screen (kiosk) mode, without the standard toolbar.

If you enable this policy, the Full Screen command on the View menu will appear dimmed, and pressing F11 will not display the browser in a full screen.

If you disable this policy or do not configure it, users can display the browser in a full screen.

This policy is intended to prevent users from displaying the browser without toolbars, which might be confusing for some beginning users.

ADM File: inetres.adm


Hide Favorites menu

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from adding, removing, or editing the list of Favorite links.

The Favorites list is a way to store popular links for future use.

If you enable this policy, the Favorites menu is removed from the interface, and the Favorites button on the browser toolbar appears dimmed. The Add to Favorites command on the shortcut menu is disabled; when users click it, they are informed that the command is unavailable.

If you disable this policy or do not configure it, users can manage their Favorites list.

This policy is intended to ensure that users maintain consistent lists of favorites across your organization.

Note

  • If you enable this policy, users also cannot click Synchronize on the Tools menu to manage their favorite links that are set up for offline viewing.

ADM File: inetres.adm


Tools menu: Disable Internet Options... menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from opening the Internet Options dialog box from the Tools menu in Microsoft Internet Explorer.

If you enable this policy, users cannot change their Internet options, such as default home page, cache size, and connection and proxy settings, from the browser Tools menu. When users click the Internet Options command on the Tools menu, they are informed that the command is unavailable.

If you disable this policy or do not configure it, users can change their Internet settings from the browser Tools menu.

Caution

  • This policy does not prevent users from viewing and changing Internet settings by clicking the Internet Options icon in Windows Control Panel.

Also, see policies for Internet options in the \Administrative Templates\Windows Components\Internet Explorer and in \Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel folders.

ADM File: inetres.adm


Help menu: Remove 'Tip of the Day' menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from viewing or changing the Tip of the Day interface in Microsoft Internet Explorer.

If you enable this policy, the Tip of the Day command is removed from the Help menu.

If you disable this policy or do not configure it, users can enable or disable the Tip of the Day, which appears at the bottom of the browser.

ADM File: inetres.adm


Help menu: Remove 'For Netscape Users' menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from displaying tips for users who are switching from Netscape.

If you enable this policy, the For Netscape Users command is removed from the Help menu.

If you disable this policy or do not configure it, users can display content about switching from Netscape by clicking the For Netscape Users command on the Help menu.

Caution

  • Enabling this policy does not remove the tips for Netscape users from the Microsoft Internet Explorer Help file.

ADM File: inetres.adm


Help menu: Remove 'Tour' menu option

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Help menu: Remove 'Tour' menu option

ADM File: inetres.adm


Help menu: Remove 'Send Feedback' menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from sending feedback to Microsoft by clicking the Send Feedback command on the Help menu.

If you enable this policy, the Send Feedback command is removed from the Help menu.

If you disable this policy or do not configure it, users can fill out an Internet form to provide feedback about Microsoft products.

ADM File: inetres.adm


Disable Context menu

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents the shortcut menu from appearing when users click the right mouse button while using the browser.

If you enable this policy, the shortcut menu will not appear when users point to a Web page, and then click the right mouse button.

If you disable this policy or do not configure it, users can use the shortcut menu.

This policy can be used to ensure that the shortcut menu is not used as an alternate method of running commands that have been removed from other parts of the interface.

ADM File: inetres.adm


Disable Open in New Window menu option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents using the shortcut menu to open a link in a new browser window.

If you enable this policy, users cannot point to a link, click the right mouse button, and then click the Open in New Window command.

If you disable this policy or do not configure it, users can open a Web page in a new browser window by using the shortcut menu.

This policy can be used in coordination with the "File menu: Disable New menu option" policy, which prevents users from opening the browser in a new window by clicking the File menu, pointing to New, and then clicking Window.

Note

  • When users click the Open in New Window command, the link will not open in a new window and they will be informed that the command is not available.

ADM File: inetres.adm


Disable Save this program to disk option

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Browser menus\

Description:
Prevents users from saving a program or file that Microsoft Internet Explorer has downloaded to the hard disk.

If you enable this policy, users cannot save a program to disk by clicking the Save This Program to Disk command while attempting to download a file. The file will not be downloaded and users will be informed that the command is not available.

If you disable this policy or do not configure it, users can download programs from their browsers.

ADM File: inetres.adm


Toolbars

Location: User Configuration\Windows Components\Internet Explorer\Toolbars

Description:
Contains settings to allow and restrict users from editing the toolbars in Internet Explorer. Administrators can also set the default toolbar buttons.

  • Disable customizing browser toolbar buttons
  • Disable customizing browser toolbars
  • Configure Toolbar Buttons

ADM File: inetres.adm


Disable customizing browser toolbar buttons

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Toolbars\

Description:
Prevents users from determining which buttons appear on the Microsoft Internet Explorer and Windows Explorer standard toolbars.

If you enable this policy, the Customize command on the Toolbars submenu of the View menu will be removed.

If you disable this policy or do not configure it, users can customize which buttons appear on the Internet Explorer and Windows Explorer toolbars.

This policy can be used in coordination with the "Disable customizing browser toolbars" policy, which prevents users from determining which toolbars are displayed in Internet Explorer and Windows Explorer.

ADM File: inetres.adm


Disable customizing browser toolbars

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Toolbars\

Description:
Prevents users from determining which toolbars are displayed in Microsoft Internet Explorer and Windows Explorer.

If you enable this policy, the list of toolbars, which users can display by clicking the View menu and then pointing to the Toolbars command, will appear dimmed.

If you disable this policy or do not configure it, users can determine which toolbars are displayed in Windows Explorer and Internet Explorer.

This policy can be used in coordination with the "Disable customizing browser toolbar buttons" policy, which prevents users from adding or removing toolbars from Internet Explorer.

ADM File: inetres.adm


Configure Toolbar Buttons

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Toolbars\

Description:
Specifies which buttons will be displayed on the standard toolbar in Microsoft Internet Explorer.

If you enable this policy, you can specify whether or not each button will be displayed by selecting or clearing the check boxes for each button.

If you disable this policy or do not configure it, the standard toolbar will be displayed with its default settings, unless users customize it.

ADM File: inetres.adm


Persistence Behavior

Location: User Configuration\Windows Components\Internet Explorer\Persistence Behavior

Description:
Contains settings for file size limits in internet security zones.

  • File size limits for Local Machine zone
  • File size limits for Intranet zone
  • File size limits for Trusted Sites zone
  • File size limits for Internet zone
  • File size limits for Restricted Sites zone

ADM File: inetres.adm


File size limits for Local Machine zone

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Persistence Behavior\

Description:
Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Computer security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note

  • This setting does not appear in the user interface.

ADM File: inetres.adm


File size limits for Intranet zone

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Persistence Behavior\

Description:
Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Local Intranet security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note

  • This setting does not appear in the user interface.

ADM File: inetres.adm


File size limits for Trusted Sites zone

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Persistence Behavior\

Description:
Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Trusted Sites security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note

  • This setting does not appear in the user interface.

ADM File: inetres.adm


File size limits for Internet zone

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Persistence Behavior\

Description:
Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Internet security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note

  • This setting does not appear in the user interface.

ADM File: inetres.adm


File size limits for Restricted Sites zone

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Persistence Behavior\

Description:
Limits the amount of storage that a page or site using the DHTML Persistence behavior can use for the Restricted Sites security zone.

If you enable this policy, you can specify the persistence storage amount per domain or per document for this security zone.

If you disable this policy or do not configure it, you cannot set this limit.

Note

  • This setting does not appear in the user interface.

ADM File: inetres.adm


Administrator Approved Controls

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls

Description:
Contains settings to enable or disable ActiveX controls.

  • Media Player
  • Menu Controls
  • Microsoft Agent
  • Microsoft Chat
  • Carpoint
  • Investor
  • MSNBC

ADM File: inetres.adm


Media Player

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates the Media Player ActiveX control as administrator-approved.

This control is used for playing sounds, videos, and other media.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator-approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


Menu Controls

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates a set of Microsoft ActiveX controls used to manipulate pop-up menus in the browser as administrator-approved.

If you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator-approved.

To specify a control as administrator-approved, click Enabled, and then select the check box for the control:

-- MCSiMenu - enables Web authors to control the placement and appearance of Windows pop-up menus on Web pages\n-- Popup Menu Object - enables Web authors to add pop-up menus to Web pages

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


Microsoft Agent

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates the Microsoft Agent ActiveX control as administrator-approved.

Microsoft Agent is a set of software services that supports the presentation of software agents as interactive personalities within the Microsoft Windows interface.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator-approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


Microsoft Chat

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates the Microsoft Chat ActiveX control as administrator-approved.

This control is used by Web authors to build text-based and graphical-based Chat communities for real-time conversations on the Web.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator-approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


Carpoint

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates the Microsoft Network (MSN) Carpoint automatic pricing control as administrator-approved.

This control enables enhanced pricing functionality on the Carpoint Web site, where users can shop for and obtain information about vehicles.

If you enable this policy, this control can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, this control will not be designated as administrator-approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


Investor

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates a set of Microsoft Network (MSN) Investor controls as administrator-approved.

These controls enable users to view updated lists of stocks on their Web pages.

If you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator-approved.

Select the check boxes for the controls that you want to designate as administrator-approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


MSNBC

Requirements: at least Internet Explorer v5.0

Location: User Configuration\Windows Components\Internet Explorer\Administrator Approved Controls\

Description:
Designates a set of MSNBC controls as administrator-approved.

These controls enable enhanced browsing of news reports on the MSNBC Web site.

If you enable this policy, these controls can be run in security zones in which you specify that administrator-approved controls can be run.

If you disable this policy or do not configure it, these controls will not be designated as administrator-approved.

Select the check boxes for the controls that you want to designate as administrator-approved.

To specify how administrator-approved controls are handled for each security zone, carry out the following steps:

1. In Group Policy, click User Configuration, click Internet Explorer Maintenance, and then click Security.

2. Double-click Security Zones and Content Ratings, click Import the Current Security Zones Settings, and then click Modify Settings.

3. Select the content zone in which you want to manage ActiveX controls, and then click Custom Level.

4. In the Run ActiveX Controls and Plug-ins area, click Administrator Approved.

ADM File: inetres.adm


Security Features

Location: User Configuration\Windows Components\Internet Explorer\Security Features

Description:
Contains settings to enable or disable security features for Internet Explorer, Windows Explorer and other applications.

  • Binary Behavior Security Restriction
  • MK Protocol Security Restriction
  • Local Machine Zone Lockdown Security
  • Consistent Mime Handling
  • Mime Sniffing Safety Feature
  • Object Caching Protection
  • Scripted Window Security Restrictions
  • Protection From Zone Elevation
  • Information Bar
  • Restrict ActiveX Install
  • Restrict File Download
  • Add-on Management
  • Network Protocol Lockdown

ADM File: inetres.adm


Binary Behavior Security Restriction

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction

Description:
Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. These binary behaviors are not controlled by any pages in zones such as Restricted Sites. In Windows XP Service Pack 2, there is a new Internet Explorer security setting for binary behaviors. This new binary behaviors security setting provides a general mitigation to vulnerabilities in Internet Explorer binary behaviors, and disables any binary behaviors for HTML rendering from the Restricted Sites zone by default.

  • Internet Explorer Processes
  • Process List
  • All Processes
  • Admin-approved behaviors

ADM File: inetres.adm


Internet Explorer Processes

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\

Description:
Windows Explorer and Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.

If you enable this policy setting, restricting content obtained through restricted protocols is allowed for Windows Explorer and Internet Explorer processes. For example, you can restrict active content from pages served over the http and https protocols by adding the value names http and https.

If you disable this policy setting, restricting content obtained through restricted protocols is prevented for Windows Explorer and Internet Explorer processes.

If you do not configure this policy setting, the policy setting is ignored.

ADM File: inetres.adm


Process List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\

Description:
Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.

This policy setting allows administrators to define applications for which they want restricting content obtained through restricted protocols to be prevented or allowed.

If you enable this policy setting and enter a Value of 1, restricting content obtained through restricted protocols is allowed. If you enter a Value of 0, restricting content obtained through restricted protocols is blocked. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.

Do not enter the Windows Explorer or Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable these processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.

If you disable or do not configure this policy setting, the security feature is allowed.

ADM File: inetres.adm


All Processes

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\

Description:
Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.

If you enable this policy setting, restricting content obtained through restricted protocols is allowed for all processes other than Windows Explorer or Internet Explorer.

If you disable this policy setting, restricting content obtained through restricted protocols is prevented for all processes other than Windows Explorer or Internet Explorer.

If you do not configure this policy setting, no policy is enforced for processes other than Windows Explorer and Internet Explorer.

ADM File: inetres.adm


Admin-approved behaviors

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction\

Description:
For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved behaviors. This list may be configured here, and applies to all processes which have opted in to the behavior, and to all zones. (Behaviors are components that encapsulate specific functionality or behavior on a page.)

If you enable this policy setting, this sets the list of behaviors permitted in each zone for which Script and Binary Behaviors is set to 'admin-approved'. Behaviors must be entered in #package#behavior notation, e.g., #default#vml.

If you disable this policy setting, no behaviors will be allowed in zones set to 'admin-approved', just as if those zones were set to 'disable'.

If you do not configure this policy setting, only VML will be allowed in zones set to 'admin-approved'.

Note. If this policy is set in both Computer Configuration and User Configuration, both lists of behaviors will be allowed as appropriate.

ADM File: inetres.adm


MK Protocol Security Restriction

Location: User Configuration\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction

Description:
In a reduction of attack surface, retired protocols are no longer supported. This feature disables the MK protocol. Resources hosted on the MK protocol will fail. Some legacy middleware apps may use this API, and this registry key can be set to allow them to continue to use it.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Local Machine Zone Lockdown Security

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security

Description:
When Internet Explorer opens a Web page, it places restrictions on what the page can do, based on the location of the Web page. For example, Web pages that are located on the Internet might not be able to perform some operations, such as accessing information from the local hard drive.

On the other hand, Web pages on the local computer are in the Local Machine zone, where they have the fewest security restrictions. The Local Machine zone is an Internet Explorer security zone, but is not displayed in the settings for Internet Explorer. The Local Machine zone allows Web content to run with fewer restrictions. Unfortunately, attackers also try to take advantage of the Local Machine zone to elevate their privileges and compromise a computer.

In Windows XP Service Pack 2, all local files and content that is processed by Internet Explorer has the security of the Local Machine zone applied to it. This differs from previous versions, where local content was considered to be secure and had no zone-based security was placed on it.

This feature dramatically restricts HTML in the Local Machine zone and controls running in the Local Machine Zone. This helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious code.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Consistent Mime Handling

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling

Description:
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) type information to decide how to handle files that have been sent by a Web server. For example, when there is a Hypertext Transfer Protocol (HTTP) request for .jpg files, on receipt are generally displayed to the user in an Internet Explorer window. If Internet Explorer receives an executable file, Internet Explorer generally prompted the user for how to handle the file.

In Windows XP Service Pack 2, Internet Explorer follows stricter rules that are designed to reduce the attack surface for spoofing the Internet Explorer MIME-handling logic.

When files are served to the client, Internet Explorer uses the following pieces of information to decide how to handle the file:

- File name extension\n- Content-Type from the HTTP header (MIME type)\n- Content-Disposition from the HTTP header\n- Results of the MIME sniff

In Windows XP Service Pack 2, Internet Explorer requires that all file-type information that is provided by Web servers is consistent. For example, if the MIME type of a file is “text/plain” but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving the file in the Internet Explorer cache and changes its extension. (In a MIME sniff, Internet Explorer examines, or sniffs, a file to recognize the bit signatures of certain types of files.)

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Mime Sniffing Safety Feature

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature

Description:
One of the backup criteria for determining a file type is the result of the MIME sniff. By examining (or sniffing) a file, Internet Explorer can recognize the bit signatures of certain types of files. In Windows XP Service Pack 2, Internet Explorer MIME sniffing will never promote a file of one type to a more dangerous file type. For example, files that are received as plain text but that include HTML code will not be promoted to the HTML type, which could contain malicious code.

In the absence of other file type information, the MIME sniff might be the only information that determines how to handle a given file download. If, for instance, Internet Explorer upgrades a text file to an HTML file, the file might execute code from the browser and possibly elevate the file’s security privilege.

Settings note: this feature can be turned off by zone in IE security zones settings.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Object Caching Protection

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Object Caching Protection

Description:
In previous versions of Windows with Internet Explorer, some Web pages could access objects cached from another Web site. In Windows XP Service Pack 2, a reference to an object is no longer accessible when the user navigates to a new domain.

For Windows XP Service Pack 2, there is now a new security context on all scriptable objects so that access to all cached objects is blocked. In addition to blocking access when navigating across domains, access is also blocked when navigating within the same domain. (In this context, a domain is defined as a fully qualified domain name (FQDN)). A reference to an object is no longer accessible after the context has changed due to navigation.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Scripted Window Security Restrictions

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions

Description:
Internet Explorer provides the capability for scripts to programmatically open additional windows of various types, and to resize and reposition existing windows. The Window Restrictions security feature restricts two types of script-initiated windows that have been used by malicious persons to deceive users: popup windows (which do not have components such as the address bar, title bar, status bar, and toolbars) and windows that include the title bar and status bar.

Script-initiated windows with the title bar and status bar are constrained in scripted movement to ensure that these important and informative bars remain visible after the operation completes.

- Scripts cannot position windows so that the title bar or address bar are above the visible top of the display.\n- Scripts cannot position windows such that the status bar is below the visible bottom of the display.\n- Script-initiated windows that include a title bar and status bar are constrained in scripted sizing to ensure that the title bar and status bar remain visible after the operation completes.\n- Scripts cannot resize windows such that the title bar, address bar, or status bar cannot be seen.\n- When creating a window, the definition of the fullscreen=yes specification is changed to mean “show the window as maximized,” which will keep the title bar, address bar, and status bar visible.

Internet Explorer has been modified to not turn off the status bar for any windows. The status bar is always visible for all Internet Explorer windows.

Script-initiated popup windows are now constrained so that they:

- Do not extend above the top or below the bottom of the parent Internet Explorer Web Object Control (WebOC) window.\n- Are smaller in height than the parent WebOC window.\n- Overlap the parent window horizontally.\n- Stay with the parent window if the parent window moves.\n- Appear above its parent so other windows (such as a dialog box) cannot be hidden.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Protection From Zone Elevation

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation

Description:
When a Web page is opened in Internet Explorer, Internet Explorer puts restrictions on what the page can do, based on where that Web page came from: the Internet, a local intranet server, a trusted site, and so on. For example, pages on the Internet have stricter security restrictions than pages on a user’s local intranet. Web pages on a user’s computer are in the Local Machine security zone, where they have the fewest security restrictions. This makes the Local Machine security zone a prime target for malicious users. Zone Elevation Blocks makes it harder to get code to run in this zone. (As a separate feature, Local Machine Zone Lockdown makes the zone less vulnerable to malicious users by changing its security settings.)

Internet Explorer prevents the overall security context for any link on a page from being higher than the security context of the root URL. This means, for example, that a page in the Internet zone cannot navigate to a page in the Local Intranet zone, except as the result of a user-initiated action. A script, for example, could not cause this navigation. For the purpose of this mitigation, the security context ranking of the zones, from highest security context to lowest, is: Restricted Sites zone, Internet zone, Local Intranet zone, Trusted Sites zone, and Local Machine zone.

Zone Elevation also disables JavaScript navigation if there is no security context.

Settings note: this feature can be turned off or set to prompt by zone in IE security zones settings.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Information Bar

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Information Bar

Description:
Enables applications hosting the Web Browser Control to automatically show the Information Bar when file downloads or code installs are restricted.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Restrict ActiveX Install

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install

Description:
Enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation. If a policy setting blocks prompting for an ActiveX control installation, the Information Bar appears instead.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Restrict File Download

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Restrict File Download

Description:
Enables applications hosting the Web Browser Control to block automatic prompting of file downloads that were not user initiated. If a policy setting blocks prompting for a file download, the Information Bar appears instead.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Add-on Management

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Add-on Management

Description:
Internet Explorer allows users and administrators to decide which add-ons are permitted to load. Applications hosting the Web Browser Control can be configured to respect the same settings as Internet Explorer.

  • Deny all add-ons unless specifically allowed in the Add-on List
  • Add-on List
  • Process List
  • All Processes

ADM File: inetres.adm


Deny all add-ons unless specifically allowed in the Add-on List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Add-on Management\

Description:
This policy setting allows you to ensure that any Internet Explorer add-ons not listed in the 'Add-on List' policy setting are denied.

By default, the 'Add-on List' policy setting defines a list of add-ons to be allowed or denied through Group Policy. However, users can still use the Add-on Manager within Internet Explorer to manage add-ons not listed within the 'Add-on List' policy setting. This policy setting effectively removes this option from users - all add-ons are assumed to be denied unless they are specifically allowed through the 'Add-on List' policy setting.

If you enable this policy setting, Internet Explorer only allows add-ins that are specifically listed (and allowed) through the 'Add-on List' policy setting.

If you disable or do not configure this policy setting, users may use Add-on Manager to allow or deny any add-ons that are not included in the 'Add-on List' policy setting.

Note

  • If an add-on is listed in the 'Add-on List' policy setting, the user cannot change its state through Add-on Manager (unless its value has been set to allow user management - see the 'Add-on List' policy for more details).

ADM File: inetres.adm


Add-on List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Add-on Management\

Description:
This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer.

This list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.

If you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:

Name of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, ‘{000000000-0000-0000-0000-0000000000000}’. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.

Value - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.

If you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied.

ADM File: inetres.adm


Network Protocol Lockdown

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown

Description:
In Windows Explorer, Internet Explorer, or any other process which opts into the security restriction, Network Protocol Lockdown may be implemented in any security zone in order to prevent active content obtained through restricted protocols from running in an unsafe manner, if the target URL is in that zone. Each zone may be set to either prompt the user when such content attempts to run, or to simply disallow the content in that zone.

  • Internet Explorer Processes
  • Process List
  • All Processes
  • Restricted Protocols Per Security Zone

ADM File: inetres.adm


Restricted Protocols Per Security Zone

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone

Description:
The list of restricted protocols governed by Network Protocol Lockdown varies per security zone. Use these policies to set the restricted protocol list for each zone.

If policy is set in both Computer Configuration and User Configuration, the two lists are combined.

  • Internet Zone Restricted Protocols
  • Intranet Zone Restricted Protocols
  • Trusted Sites Zone Restricted Protocols
  • Restricted Sites Zone Restricted Protocols
  • Local Machine Zone Restricted Protocols

ADM File: inetres.adm


Internet Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Intranet Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Trusted Sites Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Restricted Sites Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Local Machine Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: User Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Computer Configuration

Location: Computer Configuration\

Description:
Contains settings that may only be used to configure Computers

    ADM File: inetres.adm


Internet Explorer

Location: Computer Configuration\Windows Components\Internet Explorer

Description:
Contains settings to configure Internet Explorer

  • Security Zones: Use only machine settings
  • Security Zones: Do not allow users to change policies
  • Security Zones: Do not allow users to add/delete sites
  • Make proxy settings per-machine (rather than per-user)
  • Disable Automatic Install of Internet Explorer components
  • Disable Periodic Check for Internet Explorer software updates
  • Disable software update shell notifications on program launch
  • Disable showing the splash screen
  • Turn off Crash Detection
  • Do not allow users to enable or disable add-ons
  • Turn off pop-up management
  • Pop-up allow list
  • Internet Control Panel
  • Security Features

ADM File: inetres.adm


Security Zones: Use only machine settings

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Applies security zone information to all users of the same computer. A security zone is a group of Web sites with the same security level.

If you enable this policy, changes that the user makes to a security zone will apply to all users of that computer.

If you disable this policy or do not configure it, users of the same computer can establish their own security zone settings.

This policy is intended to ensure that security zone settings apply uniformly to the same computer and do not vary from user to user.

Also, see the "Security zones: Do not allow users to change policies" policy.

ADM File: inetres.adm


Security Zones: Do not allow users to change policies

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from changing security zone settings. A security zone is a group of Web sites with the same security level.

If you enable this policy, the Custom Level button and security-level slider on the Security tab in the Internet Options dialog box are disabled.

If you disable this policy or do not configure it, users can change the settings for security zones.

This policy prevents users from changing security zone settings established by the administrator.

Note

  • The "Disable the Security page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from Internet Explorer in Control Panel, takes precedence over this policy. If it is enabled, this policy is ignored.

Also, see the "Security zones: Use only machine settings" policy.

ADM File: inetres.adm


Security Zones: Do not allow users to add/delete sites

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Prevents users from adding or removing sites from security zones. A security zone is a group of Web sites with the same security level.

If you enable this policy, the site management settings for security zones are disabled. (To see the site management settings for security zones, in the Internet Options dialog box, click the Security tab, and then click the Sites button.)

If you disable this policy or do not configure it, users can add Web sites to or remove sites from the Trusted Sites and Restricted Sites zones, and alter settings for the Local Intranet zone.

This policy prevents users from changing site management settings for security zones established by the administrator.

Note

  • The "Disable the Security page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), which removes the Security tab from the interface, takes precedence over this policy. If it is enabled, this policy is ignored.

Also, see the "Security zones: Use only machine settings" policy.

ADM File: inetres.adm


Make proxy settings per-machine (rather than per-user)

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Applies proxy settings to all users of the same computer.

If you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.

If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings.

This policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user.

ADM File: inetres.adm


Disable Automatic Install of Internet Explorer components

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Prevents Internet Explorer from automatically installing components.

If you enable this policy, it prevents Internet Explorer from downloading a component when users browse to a Web site that needs that component.

If you disable this policy or do not configure it, users will be prompted to download and install a component when visiting a Web site that uses that component.

This policy is intended to help the administrator control which components the user installs.

ADM File: inetres.adm


Disable Periodic Check for Internet Explorer software updates

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Prevents Internet Explorer from checking whether a new version of the browser is available.

If you enable this policy, it prevents Internet Explorer from checking to see whether it is the latest available browser version and notifying users if a new version is available.

If you disable this policy or do not configure it, Internet Explorer checks every 30 days by default, and then notifies users if a new version is available.

This policy is intended to help the administrator maintain version control for Internet Explorer by preventing users from being notified about new versions of the browser.

ADM File: inetres.adm


Disable software update shell notifications on program launch

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Specifies that programs using the Microsoft Software Distribution Channel will not notify users when they install new components. The Software Distribution Channel is a means of updating software dynamically on users' computers by using Open Software Distribution (.osd) technologies.

If you enable this policy, users will not be notified if their programs are updated using Software Distribution Channels.

If you disable this policy or do not configure it, users will be notified before their programs are updated.

This policy is intended for administrators who want to use Software Distribution Channels to update their users' programs without user intervention.

ADM File: inetres.adm


Disable showing the splash screen

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Prevents the Internet Explorer splash screen from appearing when users start the browser.

If you enable this policy, the splash screen, which displays the program name, licensing, and copyright information, is not displayed.

If you disable this policy or do not configure it, the splash screen will be displayed when users start their browsers.

ADM File: inetres.adm


Turn off Crash Detection

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
This policy setting allows you to manage the crash detection feature of add-on Management.

If you enable this policy setting, a crash in Internet Explorer will exhibit behavior found in Windows XP Professional Service Pack 1 and earlier, namely to invoke Windows Error Reporting. All policy settings for Windows Error Reporting continue to apply.

If you disable or do not configure this policy setting, the crash detection feature for add-on management will be functional.

ADM File: inetres.adm


Do not allow users to enable or disable add-ons

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
This policy setting allows you to manage whether users have the ability to allow or deny add-ons through Add-On Manager.

If you enable this policy setting, users cannot enable or disable add-ons through Add-On Manager. The only exception occurs if an add-on has been specifically entered into the 'Add-On List' policy setting in such a way as to allow users to continue to manage the add-on. In this case, the user can still manage the add-on through the Add-On Manager.

If you disable or do not configure this policy setting, the appropriate controls in the Add-On Manager will be available to the user.

ADM File: inetres.adm


Turn off pop-up management

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
This policy setting allows you to manage pop-up management functionality in Internet Explorer.

If you enable this policy setting, the Control Panel information relating to pop-up management will be unavailable (grayed out) and all other pop-up manager controls, notifications, and dialog boxes will not appear. Pop-up windows will continue to function as they did in Windows XP Service Pack 1 or earlier, although windows launched off screen will continue to be re-positioned onscreen.

If you disable or do not configure this policy setting, the popup management feature will be functional.

ADM File: inetres.adm


Pop-up allow list

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\

Description:
Pop-up allow list

ADM File: inetres.adm


Internet Control Panel

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel

Description:
Contains settings to add or remove tabs from the Internet Options dialog.

  • Disable the General page
  • Disable the Security page
  • Disable the Content page
  • Disable the Connections page
  • Disable the Programs page
  • Disable the Privacy page
  • Disable the Advanced page
  • Security Page

ADM File: inetres.adm


Disable the General page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the General tab from the interface in the Internet Options dialog box.

If you enable this policy, users are unable to see and change settings for the home page, the cache, history, Web page appearance, and accessibility.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the General tab from the interface:

"Disable changing home page settings"

"Disable changing Temporary Internet files settings"

"Disable changing history settings"

"Disable changing color settings"

"Disable changing link color settings"

"Disable changing font settings"

"Disable changing language settings"

"Disable changing accessibility settings"

ADM File: inetres.adm


Disable the Security page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Security tab from the interface in the Internet Options dialog box.

If you enable this policy, it prevents users from seeing and changing settings for security zones, such as scripting, downloads, and user authentication.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following Internet Explorer policies, because this policy removes the Security tab from the interface:

"Security zones: Do not allow users to change policies"

"Security zones: Do not allow users to add/delete sites"

ADM File: inetres.adm


Disable the Content page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Content tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing ratings, certificates, AutoComplete, Wallet, and Profile Assistant settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Content tab from the interface:

"Disable changing ratings settings"

"Disable changing certificate settings"

"Disable changing Profile Assistant settings"

"Disable AutoComplete for forms"

"Do not allow AutoComplete to save passwords"

ADM File: inetres.adm


Disable the Connections page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Connections tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing connection and proxy settings.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Content tab, because this policy removes the Connections tab from the interface:

"Disable Internet Connection Wizard"

"Disable changing connection settings"

"Disable changing proxy settings"

"Disable changing Automatic Configuration settings"

ADM File: inetres.adm


Disable the Programs page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Programs tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for Internet programs.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the following policies for the Programs tab, because this policy removes the Programs tab from the interface:

"Disable changing Messaging settings"

"Disable changing Calendar and Contact settings"

"Disable the Reset Web Settings feature"

"Disable changing default browser check"

ADM File: inetres.adm


Disable the Privacy page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Privacy tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing default settings for privacy.

If you disable this policy or do not configure it, users can see and change these settings.

ADM File: inetres.adm


Disable the Advanced page

Requirements: at least Internet Explorer v5.0

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\

Description:
Removes the Advanced tab from the interface in the Internet Options dialog box.

If you enable this policy, users are prevented from seeing and changing advanced Internet settings, such as security, multimedia, and printing.

If you disable this policy or do not configure it, users can see and change these settings.

When you set this policy, you do not need to set the "Disable changing Advanced page settings" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\), because this policy removes the Advanced tab from the interface.

ADM File: inetres.adm


Security Page

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page

Description:
If you enable any policies for the security page, it is strongly recommended that you also configure policy to disable the security page from being presented in the UI to prevent users from believing that they can change their security settings.

You can disable the security page using the policy located at Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\.

  • Locked-Down Internet Zone
  • Locked-Down Intranet Zone
  • Locked-Down Trusted Sites Zone
  • Locked-Down Restricted Sites Zone
  • Locked-Down Local Machine Zone
  • Site to Zone Assignment List
  • Intranet Sites: Include all local (intranet) sites not listed in other zones
  • Intranet Sites: Include all sites that bypass the proxy server
  • Intranet Sites: Include all network paths (UNCs)
  • Internet Zone Template
  • Intranet Zone Template
  • Trusted Sites Zone Template
  • Restricted Sites Zone Template
  • Local Machine Zone Template
  • Locked-Down Local Machine Zone Template
  • Locked-Down Internet Zone Template
  • Locked-Down Intranet Zone Template
  • Locked-Down Trusted Sites Zone Template
  • Locked-Down Restricted Sites Zone Template

ADM File: inetres.adm


Run .NET Framework-reliant components signed with Authenticode

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether .NET Framework components that are signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.

If you enable this policy setting, Internet Explorer will execute signed managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute signed managed components.

If you disable this policy setting, Internet Explorer will not execute signed managed components.

If you do not configure this policy setting, Internet Explorer will not execute signed managed components.

ADM File: inetres.adm


Run .NET Framework-reliant components not signed with Authenticode

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether .NET Framework components that are not signed with Authenticode can be executed from Internet Explorer. These components include managed controls referenced from an object tag and managed executables referenced from a link.

If you enable this policy setting, Internet Explorer will execute unsigned managed components. If you select Prompt in the drop-down box, Internet Explorer will prompt the user to determine whether to execute unsigned managed components.

If you disable this policy setting, Internet Explorer will not execute unsigned managed components.

If you do not configure this policy setting, Internet Explorer will not execute unsigned managed components.

ADM File: inetres.adm


Download signed ActiveX controls

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users may download signed ActiveX controls from a page in the zone.

If you enable this policy, users can download signed controls without user intervention. If you select Prompt in the drop-down box, users are queried whether to download controls signed by publishers who aren't trusted. Code signed by trusted publishers is silently downloaded.

If you disable the policy setting, signed controls cannot be downloaded.

If you do not configure this policy setting, users can download signed controls without user intervention.

ADM File: inetres.adm


Download unsigned ActiveX controls

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users may download unsigned ActiveX controls from the zone. Such code is potentially harmful, especially when coming from an untrusted zone.

If you enable this policy setting, users can run unsigned controls without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to allow the unsigned control to run.

If you disable this policy setting, users cannot run unsigned controls.

If you do not configure this policy setting, users cannot run unsigned controls.

ADM File: inetres.adm


Initialize and script ActiveX controls not marked as safe

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage ActiveX controls not marked as safe. If you enable this policy setting, ActiveX controls are run, loaded with parameters, and scripted without setting object safety for untrusted data or scripts. This setting is not recommended, except for secure and administered zones. This setting causes both unsafe and safe controls to be initialized and scripted, ignoring the Script ActiveX controls marked safe for scripting option.

If you enable this policy setting and select Prompt in the drop-down box, users are queried whether to allow the control to be loaded with parameters or scripted.

If you disable this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

If you do not configure this policy setting, ActiveX controls that cannot be made safe are not loaded with parameters or scripted.

ADM File: inetres.adm


Run ActiveX controls and plugins

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether ActiveX controls and plug-ins can be run on pages from the Local Machine zone.

If you enable this policy setting, controls and plug-ins can run without user intervention.

If you selected Prompt in the drop-down box, users are asked to choose whether to allow the controls or plug-in to run.

If you disable this policy setting, controls and plug-ins are prevented from running.

If you do not configure this policy setting, controls and plug-ins are prevented from running.

ADM File: inetres.adm


Script ActiveX controls marked safe for scripting

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether an ActiveX control marked safe for scripting can interact with a script.

If you enable this policy setting, script interaction can occur automatically without user intervention.

If you select Prompt in the drop-down box, users are queried to choose whether to allow script interaction.

If you disable this policy setting, script interaction is prevented from occurring.

If you do not configure this policy setting, script interaction can occur automatically without user intervention.

ADM File: inetres.adm


Allow file downloads

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether file downloads are permitted from the Local Machine zone. This option is determined by the zone of the page with the link causing the download, not the zone from which the file is delivered.

If you enable this policy setting, files can be downloaded from the zone.

If you disable this policy setting, files are prevented from being downloaded from the zone.

If you do not configure this policy setting, files can be downloaded from the zone.

ADM File: inetres.adm


Allow font downloads

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.

If you disable this policy setting, HTML fonts are prevented from downloading.

If you do not configure this policy setting, HTML fonts can be downloaded automatically.

ADM File: inetres.adm


Java permissions

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage permissions for Java applets.

If you enable this policy setting, you can choose options from the drop-down box. Custom, to control permissions settings individually.

Low Safety enables applets to perform all operations.

Medium Safety enables applets to run in their sandbox (an area in memory outside of which the program cannot make calls), plus capabilities like scratch space (a safe and secure storage area on the client computer) and user-controlled file I/O.

High Safety enables applets to run in their sandbox. Disable Java to prevent any applets from running.

If you disable this policy setting, Java applets cannot run.

If you do not configure this policy setting, Java applets are disabled.

ADM File: inetres.adm


Access data sources across domains

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether Internet Explorer can access data from another security zone using the Microsoft XML Parser (MSXML) or ActiveX Data Objects (ADO).

If you enable this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone. If you select Prompt in the drop-down box, users are queried to choose whether to allow a page to be loaded in the zone that uses MSXML or ADO to access data from another site in the zone.

If you disable this policy setting, users cannot load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

If you do not configure this policy setting, users can load a page in the zone that uses MSXML or ADO to access data from another site in the zone.

ADM File: inetres.adm


Allow active content over restricted protocols to access my computer

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone\

Description:
This policy setting allows you to manage whether a resource hosted on an admin-restricted protocol in the Local Machine Zone can run active content such as script, ActiveX, Java and Binary Behaviors. The list of restricted protocols may be set in the Local Machine Zone Restricted Protocols section under Network Protocol Lockdown policy.

If you enable this policy setting, no Local Machine Zone content accessed is affected, even for protocols on the restricted list. If you select Prompt from the drop-down box, the Information Bar will appear to allow control over questionable content accessed over any restricted protocols; content over other protocols is unaffected.

If you disable this policy setting, all attempts to access such content over the restricted protocols is blocked.

If you do not configure this policy setting, no content is restricted unless the Network Protocol Lockdown security feature is enabled.

ADM File: inetres.adm


Automatic prompting for file downloads

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting determines whether users will be prompted for non user-initiated file downloads. Regardless of this setting, users will receive file download dialogs for user-initiated downloads.

If you enable this setting, users will receive a file download dialog for automatic download attempts.

If you disable or do not configure this setting, file downloads that are not user-initiated will be blocked, and users will see the Information Bar instead of the file download dialog. Users can then click the Information Bar to allow the file download prompt.

ADM File: inetres.adm


Automatic prompting for ActiveX controls

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting manages whether users will be automatically prompted for ActiveX control installations.

If you enable this policy setting, users will receive a prompt when a site instantiates an ActiveX control they do not have installed.

If you disable this policy setting, ActiveX control installations will be blocked using the Information Bar. Users can click on the Information Bar to allow the ActiveX control prompt.

If you do not configure this policy setting, the user’s preference will be used to determine whether to block ActiveX control installations using the Information Bar.

ADM File: inetres.adm


Allow META REFRESH

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether a user's browser can be redirected to another Web page if the author of the Web page uses the Meta Refresh setting (tag) to redirect browsers to another Web page.

If you enable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting, can be redirected to another Web page.

If you disable this policy setting, a user's browser that loads a page containing an active Meta Refresh setting, cannot be redirected to another Web page.

If you do not configure this policy setting, a user's browser that loads a page containing an active Meta Refresh setting, can be redirected to another Web page.

ADM File: inetres.adm


Allow script-initiated windows without size or position constraints

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage restrictions on script-initiated pop-up windows and windows that include the title and status bars.

If you enable this policy setting, Windows Restrictions security will not apply in the Local Machine zone. The security zone runs without the added layer of security provided by this feature.

If you disable this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in the Local Machine zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

If you do not configure this policy setting, the possible harmful actions contained in script-initiated pop-up windows and windows that include the title and status bars cannot be run. This Internet Explorer security feature will be on in the Local Machine zone as dictated by the Scripted Windows Security Restrictions feature control setting for the process.

ADM File: inetres.adm


Allow binary and script behaviors

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage dynamic binary and script behaviors: components that encapsulate specific functionality for HTML elements to which they were attached.

If you enable this policy setting, binary and script behaviors are available. If you select Administrator approved in the drop-down box, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.

If you disable this policy setting, binary and script behaviors are not available unless applications have implemented a custom security manager.

If you do not configure this policy setting, only behaviors listed in the Admin-approved Behaviors under Binary Behaviors Security Restriction policy are available.

ADM File: inetres.adm


Display mixed content

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users can display nonsecure items and manage whether users receive a security information message to display pages containing both secure and nonsecure items.

If you enable this policy setting, and the drop-down box is set to Enable, the user does not receive a security information message (This page contains both secure and nonsecure items. Do you want to display the nonsecure items?) and nonsecure content can be displayed.

If the drop-down box is set to Prompt, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.

If you disable this policy setting, users cannot receive the security information message and nonsecure content cannot be displayed.

If you do not configure this policy setting, the user will receive the security information message on the Web pages that contain both secure (https://) and nonsecure (http://) content.

ADM File: inetres.adm


Do not prompt for client certificate selection when no certificates or only one certificate exists.

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users are prompted to select a certificate when no certificate or only one certificate exists.

If you enable this policy setting, Internet Explorer does not prompt users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate.

If you disable this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate.

If you do not configure this policy setting, Internet Explorer prompts users with a Client Authentication message when they connect to a Web site that has no certificate or only one certificate.

ADM File: inetres.adm


Allow drag and drop or copy and paste files

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users can drag files or copy and paste files from a source within the Local Machine zone.

If you enable this policy setting, users can drag files or copy and paste files from the Local Machine zone automatically. If you select Prompt in the drop-down box, users are queried to choose whether to drag or copy files from the Local Machine zone.

If you disable this policy setting, users are prevented from dragging files or copying and pasting files from the Local Machine zone.

If you do not configure this policy setting, users can drag files or copy and paste files from the Local machine zone automatically.

ADM File: inetres.adm


Allow installation of desktop items

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether users can install Active Desktop items from the Local Machine zone. The settings for this option are: If you enable this policy setting, users can install desktop items from the Local Machine zone automatically.

If you select Prompt in the drop-down box, users are queried to choose whether to install desktop items from the Local Machine zone.

If you disable this policy setting, users are prevented from installing desktop items from the Local Machine zone.

If you do not configure this policy setting, users can install desktop items from the Local Machine zone automatically.

ADM File: inetres.adm


Launching applications and files in an IFRAME

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether applications may be run and files may be downloaded from an IFRAME reference in the HTML of the pages in this zone.

If you enable this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention. If you select Prompt in the drop-down box, users are queried to choose whether to run applications and download files from IFRAMEs on the pages in this zone.

If you disable this policy setting, users are prevented from running applications and downloading files from IFRAMEs on the pages in this zone.

If you do not configure this policy setting, users can run applications and download files from IFRAMEs on the pages in this zone without user intervention.

ADM File: inetres.adm


Navigate sub-frames across different domains

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage the opening of sub-frames and access of applications across different domains.

If you enable this policy setting, users can open additional sub-frames from other domains and access applications from other domains. If you select Prompt in the drop-down box, users are queried whether to allow additional sub-frames or access to applications from other domains.

If you disable this policy setting, users cannot open other sub-frames or access applications from different domains.

If you do not configure this policy setting, users can open additional sub-frames from other domains and access applications from other domains.

ADM File: inetres.adm


Open files based on content, not file extension

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage MIME sniffing for file promotion from one type to another based on a MIME sniff. A MIME sniff is the recognition by Internet Explorer of the file type based on a bit signature.

If you enable this policy setting, the MIME Sniffing Safety Feature will not apply in the Local Machine zone. The security zone will run without the added layer of security provided by this feature.

If you disable this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in the Local Machine zone, as dictated by the feature control setting for the process.

If you do not configure this policy setting, the actions that may be harmful cannot run; this Internet Explorer security feature will be turned on in the Local Machine zone, as dictated by the feature control setting for the process.

ADM File: inetres.adm


Software channel permissions

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage software channel permissions.

If you enable this policy setting, you can choose the following options from the drop-down box.

Low safety to allow users to be notified of software updates by e-mail, software packages to be automatically downloaded to users' computers, and software packages to be automatically installed on users' computers.

Medium safety to allow users to be notified of software updates by e-mail and software packages to be automatically downloaded to (but not installed on) users' computers.

High safety to prevent users from being notified of software updates by e-mail, software packages from being automatically downloaded to users' computers, and software packages from being automatically installed on users' computers.

If you disable this policy setting, permissions are set to high safety.

If you do not configure this policy setting, permissions are set to Low safety.

ADM File: inetres.adm


Submit non-encrypted form data

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether data on HTML forms on pages in the Local Machine zone may be submitted. Forms sent with SSL (Secure Sockets Layer) encryption are always allowed; this setting only affects non-SSL form data submission.

If you enable this policy setting, information using HTML forms on pages in the Local Machine zone can be submitted automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow information using HTML forms on pages in the Local Machine zone to be submitted.

If you disable this policy setting, information using HTML forms on pages in the Local Machine zone is prevented from being submitted.

If you do not configure this policy setting, information using HTML forms on pages in the Local Machine zone can be submitted automatically.

ADM File: inetres.adm


Use Pop-up Blocker

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether unwanted pop-up windows appear. Pop-up windows that are opened when the end user clicks a link are not blocked.

If you enable this policy setting, most unwanted pop-up windows are prevented from appearing.

If you disable this policy setting, pop-up windows are not prevented from appearing.

If you do not configure this policy setting, pop-up windows are not prevented from appearing.

ADM File: inetres.adm


Userdata persistence

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage the preservation of information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk. When a user returns to a persisted page, the state of the page can be restored if this policy setting is appropriately configured.

If you enable this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you disable this policy setting, users cannot preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

If you do not configure this policy setting, users can preserve information in the browser's history, in favorites, in an XML store, or directly within a Web page saved to disk.

ADM File: inetres.adm


Web sites in less privileged Web content zones can navigate into this zone

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether Web sites from less privileged zones, such as Internet sites, can navigate to the Local Machine zone.

If you enable this policy setting, Web sites from less privileged zones can open new windows in, or navigate into, the Local Machine zone. The security zone will run without the added layer of security that is provided by the Protection from Zone Elevation security feature. If you select Prompt in the drop-down box, a warning is issued to the user that potentially risky navigation is about to occur.

If you disable this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in the Local Machine zone as set by Protection from Zone Elevation feature control.

If you do not configure this policy setting, the possibly harmful navigations are prevented. The Internet Explorer security feature will be on in the Local Machine zone as set by Protection from Zone Elevation feature control.

ADM File: inetres.adm


Allow active scripting

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether script code on pages in the Local Machine zone is run.

If you enable this policy setting, script code on pages in the Local Machine zone can run automatically. If you select Prompt in the drop-down box, users are queried to choose whether to allow script code on pages in the Local Machine zone to run.

If you disable this policy setting, script code on pages in the Local Machine zone is prevented from running.

If you do not configure this policy setting, users are queried to choose whether to allow script code on pages in the Local Machine zone to run.

ADM File: inetres.adm


Allow paste operations via script

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether scripts can perform a clipboard operation (for example, cut, copy, and paste) in a specified region.

If you enable this policy setting, a script can perform a clipboard operation.

If you disable this policy, a script cannot perform a clipboard operation.

If you do not configure this policy setting, a script can perform a clipboard operation.

ADM File: inetres.adm


Scripting of Java applets

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage whether applets are exposed to scripts within the zone.

If you enable this policy setting, scripts can access applets automatically without user intervention.

If you select Prompt in the drop-down box, users are queried to choose whether to allow scripts to access applets.

If you disable this policy setting, scripts are prevented from accessing applets.

If you do not configure this policy setting, scripts can access applets automatically without user intervention.

ADM File: inetres.adm


Logon options

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone\

Description:
This policy setting allows you to manage settings for logon options.

If you enable this policy setting, you can choose from the following logon options:

Anonymous logon to disable HTTP authentication and use the guest account only for the Common Internet File System (CIFS) protocol.

Prompt for user name and password to query users for user IDs and passwords. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon only in Intranet zone to query users for user IDs and passwords in other zones. After a user is queried, these values can be used silently for the remainder of the session.

Automatic logon with current user name and password to attempt logon using Windows NT Challenge Response (also known as NTLM authentication). If Windows NT Challenge Response is supported by the server, the logon uses the user's network user name and password for logon. If Windows NT Challenge Response is not supported by the server, the user is queried to provide the user name and password.

If you disable this policy setting, logon is set to Automatic logon only in Intranet zone.

If you do not configure this policy setting, logon is set to Automatic logon with current username and password.

ADM File: inetres.adm


Locked-Down Internet Zone

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone

Description:
The settings in this zone apply only if the Internet Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Internet Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Intranet Zone

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone

Description:
The settings in this zone apply only if the Intranet Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Intranet Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Trusted Sites Zone

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone

Description:
The settings in this zone apply only if the Trusted Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Trusted Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Restricted Sites Zone

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone

Description:
The settings in this zone apply only if the Restricted Zone is in 'lockdown' mode, such as when the Network Protocol Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Restricted Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the relevant behavior is strictly blocked, preventing the zone from operating with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Locked-Down Local Machine Zone

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone

Description:
The settings in this zone apply only if the Local Machine Zone is in 'lockdown' mode, such as when the Local Machine Zone Lockdown security feature is in effect. If the zone is locked down, these URL action settings do not override the standard Local Machine Zone settings, but are compared against them. If the settings for that URL action in the two zones are the same, then that setting is used. Otherwise, the user is presented with an Information Bar, and may allow the zone to operate with the standard (non-lockdown) zone's setting.

  • Run .NET Framework-reliant components signed with Authenticode
  • Run .NET Framework-reliant components not signed with Authenticode
  • Download signed ActiveX controls
  • Download unsigned ActiveX controls
  • Initialize and script ActiveX controls not marked as safe
  • Run ActiveX controls and plugins
  • Script ActiveX controls marked safe for scripting
  • Allow file downloads
  • Allow font downloads
  • Java permissions
  • Access data sources across domains
  • Automatic prompting for file downloads
  • Automatic prompting for ActiveX controls
  • Allow META REFRESH
  • Allow script-initiated windows without size or position constraints
  • Allow binary and script behaviors
  • Display mixed content
  • Do not prompt for client certificate selection when no certificates or only one certificate exists.
  • Allow drag and drop or copy and paste files
  • Allow installation of desktop items
  • Launching applications and files in an IFRAME
  • Navigate sub-frames across different domains
  • Open files based on content, not file extension
  • Software channel permissions
  • Submit non-encrypted form data
  • Use Pop-up Blocker
  • Userdata persistence
  • Web sites in less privileged Web content zones can navigate into this zone
  • Allow active scripting
  • Allow paste operations via script
  • Scripting of Java applets
  • Logon options

ADM File: inetres.adm


Site to Zone Assignment List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.

Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)

If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site. For each entry that you add to the list, enter the following information:

Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.

Value - A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.

If you disable this policy setting, any such list is deleted and no site-to-zone assignments are permitted.

If this policy is not configured, users may choose their own site-to-zone assignments.

ADM File: inetres.adm


Intranet Sites: Include all local (intranet) sites not listed in other zones

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting controls whether local sites which are not explicitly mapped into any Security Zone are forced into the local Intranet security zone.

If you enable this policy setting, local sites which are not explicitly mapped into a zone are considered to be in the Intranet Zone.

If you disable this policy setting, local sites which are not explicitly mapped into a zone will not be considered to be in the Intranet Zone (so would typically be in the Internet Zone).

If you do not configure this policy setting, users choose whether to force local sites into the Intranet Zone.

ADM File: inetres.adm


Intranet Sites: Include all sites that bypass the proxy server

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting controls whether sites which bypass the proxy server are mapped into the local Intranet security zone.

If you enable this policy setting, sites which bypass the proxy server are mapped into the Intranet Zone.

If you disable this policy setting, sites which bypass the proxy server aren't necessarily mapped into the Intranet Zone (other rules might map one there).

If you do not configure this policy setting, users choose whether sites which bypass the proxy server are mapped into the Intranet Zone.

ADM File: inetres.adm


Intranet Sites: Include all network paths (UNCs)

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This policy setting controls whether URLs representing UNCs are mapped into the local Intranet security zone.

If you enable this policy setting, all network paths are mapped into the Intranet Zone.

If you disable this policy setting, network paths are not necessarily mapped into the Intranet Zone (other rules might map one there).

If you do not configure this policy setting, users choose whether network paths are mapped into the Intranet Zone.

ADM File: inetres.adm


Internet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Intranet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Trusted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Restricted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Local Machine Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Local Machine Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Internet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Intranet Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Trusted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Locked-Down Restricted Sites Zone Template

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\

Description:
This template policy setting allows you to configure policy settings in this zone consistent with a selected security level, for example, Low, Medium Low, Medium, or High.

If you enable this template policy setting and select a security level, all values for individual settings in the zone will be overwritten by the standard template defaults.

If you disable this template policy setting, no security level is configured.

If you do not configure this template policy setting, no security level is configured.

Note. Local Machine Zone Lockdown Security and Network Protocol Lockdown operate by comparing the settings in the active URL's zone against those in the Locked-Down equivalent zone. If you select a security level for any zone (including selecting no security), the same change should be made to the Locked-Down equivalent.

Note. It is recommended to configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific targets.

ADM File: inetres.adm


Automatically check for Internet Explorer updates

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manager whether Internet Explorer checks the Internet for newer versions. When Internet Explorer is set to do this, the checks occur approximately every 30 days, and users are prompted to install new versions as they become available.

If you enable this policy setting, Internet Explorer checks the Internet for a new version approximately every 30 days and prompts the user to download new versions when they are available.

If you disable this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them.

If you do not configure this policy setting, Internet Explorer does not check the Internet for new versions of the browser, so does not prompt users to install them.

ADM File: inetres.adm


Enable Install On Demand (Internet Explorer)

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users can automatically download and install Web components (such as fonts) that can installed by Internet Explorer Active Setup. For example, if you open a Web page that requires Japanese-text display support, Internet Explorer could prompt the user to download the Japanese Language Pack component if it is not already installed.

If you enable this policy setting, Web components such as fonts will be automatically installed as necessary.

If you disable this policy setting, users will be prompted when Web Components such as fonts would be downloaded.

If you do not configure this policy, users will be prompted when Web Components such as fonts would be downloaded.

ADM File: inetres.adm


Enable Install On Demand (Other)

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users can download and install self-installing program files (non-Internet Explorer components) that are registered with Internet Explorer (such as Windows Media Player, Macromedia, and Java) that are required in order to view web pages as intended.

If you enable this policy setting, non-Internet Explorer components will be automatically installed as necessary.

If you disable this policy setting, users will be prompted when non-Internet Explorer components would be installed.

If you do not configure this policy setting, non-Internet Explorer components will be automatically installed as necessary.

ADM File: inetres.adm


Enable third-party browser extensions

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users can download add-ons known as browser helper objects (BHOs), such as toolbars. BHOs may contain flaws such as buffer overruns which impact Internet Explorer’s performance or stability.

If you enable this policy setting, users can download and launch browser helper objects.

If you disable this policy setting, users are blocked from downloading or launching browser helper objects.

If you do not configure this policy, users can download and launch browser helper objects.

ADM File: inetres.adm


Play animations in web pages

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will display animated pictures found in Web content. Generally only animated GIF files are affected by this setting; active Web content such as java applets are not.

If you enable this policy setting, Internet Explorer will play animated pictures found in Web content.

If you disable this policy setting, Internet Explorer will not play or download animated pictures, helping pages display more quickly.

If you do not configure this policy setting, Internet Explorer will play animated pictures found in Web content.

ADM File: inetres.adm


Play sounds in web pages

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will play sounds found in web content. Generally only sound files such as MIDI files are affected by this setting; active Web content such as java applets are not.

If you enable this policy setting, Internet Explorer will play sounds found in Web content.

If you disable this policy setting, Internet Explorer will not play or download sounds in Web content, helping pages display more quickly.

If you enable this policy setting, Internet Explorer will play sounds found in Web content.

ADM File: inetres.adm


Play videos in web pages

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will display videos found in Web content. Generally only video files such as MIDI files are affected by this setting; active Web content such as java applets are not.

If you enable this policy setting, Internet Explorer will play videos found in Web content.

If you disable this policy setting, Internet Explorer will not play or download videos, helping pages display more quickly.

If you do not configure this policy setting, Internet Explorer will play videos found in Web content.

ADM File: inetres.adm


Allow active content from CDs to run on user machines

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether users receive a dialog requesting permission for active content on a CD to run.

If you enable this policy setting, active content on a CD will run without a prompt.

If you disable this policy setting, active content on a CD will always prompt before running.

If you do not configure this policy, users can choose whether to be prompted before running active content on a CD.

ADM File: inetres.adm


Allow software to run or install even if the signature is invalid

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether software, such as ActiveX controls and file downloads, can be installed or run by the user even though the signature is invalid. An invalid signature might indicate that someone has tampered with the file.

If you enable this policy setting, users will be prompted to install or run files with an invalid signature.

If you disable this policy setting, users cannot run or install files with an invalid signature.

If you do not configure this policy, users can choose to run or install files with an invalid signature.

ADM File: inetres.adm


Check for server certificate revocation

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will check revocation status of servers' certificates. Certificates are revoked when they have been compromised or are no longer valid, and this option protects users from submitting confidential data to a site that may be fraudulent or not secure.

If you enable this policy setting, Internet Explorer will check to see if server certificates have been revoked.

If you disable this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

If you do not configure this policy setting, Internet Explorer will not check server certificates to see if they have been revoked.

ADM File: inetres.adm


Check for signatures on downloaded programs

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer checks for digital signatures (which identifies the publisher of signed software and verifies it hasn't been modified or tampered with) on user computers before downloading executable programs.

If you enable this policy setting, Internet Explorer will check the digital signatures of executable programs and display their identities before downloading them to user computers.

If you disable this policy setting, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

If you do not configure this policy, Internet Explorer will not check the digital signatures of executable programs or display their identities before downloading them to user computers.

ADM File: inetres.adm


Do not save encrypted pages to disk

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer will save encrypted pages that contain secure (HTTPS) information such as passwords and credit card numbers to a disk, which may be insecure.

If you enable this policy setting, Internet Explorer will not save encrypted pages containing secure (HTTPS) information to the user's disk.

If you disable this policy setting, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the user's disk.

If you do not configure this policy, Internet Explorer will save encrypted pages containing secure (HTTPS) information to the user's disk

ADM File: inetres.adm


Empty Temporary Internet Files folder when browser is closed

Requirements: at least Internet Explorer v6.0 in Windows 2003 Service Pack 1

Location: Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page\

Description:
This policy setting allows you to manage whether Internet Explorer deletes the contents of the Temporary Internet Files folder after all browser windows are closed. This protects against storing dangerous files on the computer, or storing sensitive files that other users could see, in addition to managing total disk space usage.

If you enable this policy setting, Internet Explorer will delete the contents of the user's Temporary Internet Files folder when all browser windows are closed.

If you disable this policy setting, Internet Explorer will not delete the contents of the user's Temporary Internet Files folder when browser windows are closed.

If you do not configure this policy, Internet Explorer will not delete the contents of the Temporary Internet Files folder when browser windows are closed.

ADM File: inetres.adm


Security Features

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features

Description:
Contains settings to enable or disable security features for Internet Explorer, Windows Explorer and other applications.

  • Binary Behavior Security Restriction
  • MK Protocol Security Restriction
  • Local Machine Zone Lockdown Security
  • Consistent Mime Handling
  • Mime Sniffing Safety Feature
  • Object Caching Protection
  • Scripted Window Security Restrictions
  • Protection From Zone Elevation
  • Information Bar
  • Restrict ActiveX Install
  • Restrict File Download
  • Add-on Management
  • Network Protocol Lockdown

ADM File: inetres.adm


Binary Behavior Security Restriction

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction

Description:
Internet Explorer contains dynamic binary behaviors: components that encapsulate specific functionality for HTML elements to which they were attached. These binary behaviors are not controlled by any pages in zones such as Restricted Sites. In Windows XP Service Pack 2, there is a new Internet Explorer security setting for binary behaviors. This new binary behaviors security setting provides a general mitigation to vulnerabilities in Internet Explorer binary behaviors, and disables any binary behaviors for HTML rendering from the Restricted Sites zone by default.

  • Internet Explorer Processes
  • Process List
  • All Processes
  • Admin-approved behaviors

ADM File: inetres.adm


Internet Explorer Processes

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\

Description:
Windows Explorer and Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.

If you enable this policy setting, restricting content obtained through restricted protocols is allowed for Windows Explorer and Internet Explorer processes. For example, you can restrict active content from pages served over the http and https protocols by adding the value names http and https.

If you disable this policy setting, restricting content obtained through restricted protocols is prevented for Windows Explorer and Internet Explorer processes.

If you do not configure this policy setting, the policy setting is ignored.

ADM File: inetres.adm


Process List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\

Description:
Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.

This policy setting allows administrators to define applications for which they want restricting content obtained through restricted protocols to be prevented or allowed.

If you enable this policy setting and enter a Value of 1, restricting content obtained through restricted protocols is allowed. If you enter a Value of 0, restricting content obtained through restricted protocols is blocked. The Value Name is the name of the executable. If a Value Name is empty or the Value is not 0 or 1, the policy setting is ignored.

Do not enter the Windows Explorer or Internet Explorer processes in this list: use the related Internet Explorer Processes policy to enable or disable these processes. If the All Processes policy setting is enabled, the processes configured in this box take precedence over that setting.

If you disable or do not configure this policy setting, the security feature is allowed.

ADM File: inetres.adm


All Processes

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\

Description:
Internet Explorer may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner. This policy setting controls whether restricting content obtained through restricted protocols is prevented or allowed.

If you enable this policy setting, restricting content obtained through restricted protocols is allowed for all processes other than Windows Explorer or Internet Explorer.

If you disable this policy setting, restricting content obtained through restricted protocols is prevented for all processes other than Windows Explorer or Internet Explorer.

If you do not configure this policy setting, no policy is enforced for processes other than Windows Explorer and Internet Explorer.

ADM File: inetres.adm


Admin-approved behaviors

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Binary Behavior Security Restriction\

Description:
For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved behaviors. This list may be configured here, and applies to all processes which have opted in to the behavior, and to all zones. (Behaviors are components that encapsulate specific functionality or behavior on a page.)

If you enable this policy setting, this sets the list of behaviors permitted in each zone for which Script and Binary Behaviors is set to 'admin-approved'. Behaviors must be entered in #package#behavior notation, e.g., #default#vml.

If you disable this policy setting, no behaviors will be allowed in zones set to 'admin-approved', just as if those zones were set to 'disable'.

If you do not configure this policy setting, only VML will be allowed in zones set to 'admin-approved'.

Note. If this policy is set in both Computer Configuration and User Configuration, both lists of behaviors will be allowed as appropriate.

ADM File: inetres.adm


MK Protocol Security Restriction

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\MK Protocol Security Restriction

Description:
In a reduction of attack surface, retired protocols are no longer supported. This feature disables the MK protocol. Resources hosted on the MK protocol will fail. Some legacy middleware apps may use this API, and this registry key can be set to allow them to continue to use it.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Local Machine Zone Lockdown Security

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Local Machine Zone Lockdown Security

Description:
When Internet Explorer opens a Web page, it places restrictions on what the page can do, based on the location of the Web page. For example, Web pages that are located on the Internet might not be able to perform some operations, such as accessing information from the local hard drive.

On the other hand, Web pages on the local computer are in the Local Machine zone, where they have the fewest security restrictions. The Local Machine zone is an Internet Explorer security zone, but is not displayed in the settings for Internet Explorer. The Local Machine zone allows Web content to run with fewer restrictions. Unfortunately, attackers also try to take advantage of the Local Machine zone to elevate their privileges and compromise a computer.

In Windows XP Service Pack 2, all local files and content that is processed by Internet Explorer has the security of the Local Machine zone applied to it. This differs from previous versions, where local content was considered to be secure and had no zone-based security was placed on it.

This feature dramatically restricts HTML in the Local Machine zone and controls running in the Local Machine Zone. This helps to mitigate attacks where the Local Machine zone is used as an attack vector to load malicious code.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Consistent Mime Handling

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Consistent Mime Handling

Description:
Internet Explorer uses Multipurpose Internet Mail Extensions (MIME) type information to decide how to handle files that have been sent by a Web server. For example, when there is a Hypertext Transfer Protocol (HTTP) request for .jpg files, on receipt are generally displayed to the user in an Internet Explorer window. If Internet Explorer receives an executable file, Internet Explorer generally prompted the user for how to handle the file.

In Windows XP Service Pack 2, Internet Explorer follows stricter rules that are designed to reduce the attack surface for spoofing the Internet Explorer MIME-handling logic.

When files are served to the client, Internet Explorer uses the following pieces of information to decide how to handle the file:

- File name extension\n- Content-Type from the HTTP header (MIME type)\n- Content-Disposition from the HTTP header\n- Results of the MIME sniff

In Windows XP Service Pack 2, Internet Explorer requires that all file-type information that is provided by Web servers is consistent. For example, if the MIME type of a file is “text/plain” but the MIME sniff indicates that the file is really an executable file, Internet Explorer renames the file by saving the file in the Internet Explorer cache and changes its extension. (In a MIME sniff, Internet Explorer examines, or sniffs, a file to recognize the bit signatures of certain types of files.)

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Mime Sniffing Safety Feature

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Mime Sniffing Safety Feature

Description:
One of the backup criteria for determining a file type is the result of the MIME sniff. By examining (or sniffing) a file, Internet Explorer can recognize the bit signatures of certain types of files. In Windows XP Service Pack 2, Internet Explorer MIME sniffing will never promote a file of one type to a more dangerous file type. For example, files that are received as plain text but that include HTML code will not be promoted to the HTML type, which could contain malicious code.

In the absence of other file type information, the MIME sniff might be the only information that determines how to handle a given file download. If, for instance, Internet Explorer upgrades a text file to an HTML file, the file might execute code from the browser and possibly elevate the file’s security privilege.

Settings note: this feature can be turned off by zone in IE security zones settings.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Object Caching Protection

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Object Caching Protection

Description:
In previous versions of Windows with Internet Explorer, some Web pages could access objects cached from another Web site. In Windows XP Service Pack 2, a reference to an object is no longer accessible when the user navigates to a new domain.

For Windows XP Service Pack 2, there is now a new security context on all scriptable objects so that access to all cached objects is blocked. In addition to blocking access when navigating across domains, access is also blocked when navigating within the same domain. (In this context, a domain is defined as a fully qualified domain name (FQDN)). A reference to an object is no longer accessible after the context has changed due to navigation.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Scripted Window Security Restrictions

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Scripted Window Security Restrictions

Description:
Internet Explorer provides the capability for scripts to programmatically open additional windows of various types, and to resize and reposition existing windows. The Window Restrictions security feature restricts two types of script-initiated windows that have been used by malicious persons to deceive users: popup windows (which do not have components such as the address bar, title bar, status bar, and toolbars) and windows that include the title bar and status bar.

Script-initiated windows with the title bar and status bar are constrained in scripted movement to ensure that these important and informative bars remain visible after the operation completes.

- Scripts cannot position windows so that the title bar or address bar are above the visible top of the display.\n- Scripts cannot position windows such that the status bar is below the visible bottom of the display.\n- Script-initiated windows that include a title bar and status bar are constrained in scripted sizing to ensure that the title bar and status bar remain visible after the operation completes.\n- Scripts cannot resize windows such that the title bar, address bar, or status bar cannot be seen.\n- When creating a window, the definition of the fullscreen=yes specification is changed to mean “show the window as maximized,” which will keep the title bar, address bar, and status bar visible.

Internet Explorer has been modified to not turn off the status bar for any windows. The status bar is always visible for all Internet Explorer windows.

Script-initiated popup windows are now constrained so that they:

- Do not extend above the top or below the bottom of the parent Internet Explorer Web Object Control (WebOC) window.\n- Are smaller in height than the parent WebOC window.\n- Overlap the parent window horizontally.\n- Stay with the parent window if the parent window moves.\n- Appear above its parent so other windows (such as a dialog box) cannot be hidden.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Protection From Zone Elevation

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Protection From Zone Elevation

Description:
When a Web page is opened in Internet Explorer, Internet Explorer puts restrictions on what the page can do, based on where that Web page came from: the Internet, a local intranet server, a trusted site, and so on. For example, pages on the Internet have stricter security restrictions than pages on a user’s local intranet. Web pages on a user’s computer are in the Local Machine security zone, where they have the fewest security restrictions. This makes the Local Machine security zone a prime target for malicious users. Zone Elevation Blocks makes it harder to get code to run in this zone. (As a separate feature, Local Machine Zone Lockdown makes the zone less vulnerable to malicious users by changing its security settings.)

Internet Explorer prevents the overall security context for any link on a page from being higher than the security context of the root URL. This means, for example, that a page in the Internet zone cannot navigate to a page in the Local Intranet zone, except as the result of a user-initiated action. A script, for example, could not cause this navigation. For the purpose of this mitigation, the security context ranking of the zones, from highest security context to lowest, is: Restricted Sites zone, Internet zone, Local Intranet zone, Trusted Sites zone, and Local Machine zone.

Zone Elevation also disables JavaScript navigation if there is no security context.

Settings note: this feature can be turned off or set to prompt by zone in IE security zones settings.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Information Bar

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Information Bar

Description:
Enables applications hosting the Web Browser Control to automatically show the Information Bar when file downloads or code installs are restricted.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Restrict ActiveX Install

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Restrict ActiveX Install

Description:
Enables applications hosting the Web Browser Control to block automatic prompting of ActiveX control installation. If a policy setting blocks prompting for an ActiveX control installation, the Information Bar appears instead.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Restrict File Download

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Restrict File Download

Description:
Enables applications hosting the Web Browser Control to block automatic prompting of file downloads that were not user initiated. If a policy setting blocks prompting for a file download, the Information Bar appears instead.

  • Internet Explorer Processes
  • Process List
  • All Processes

ADM File: inetres.adm


Add-on Management

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Add-on Management

Description:
Internet Explorer allows users and administrators to decide which add-ons are permitted to load. Applications hosting the Web Browser Control can be configured to respect the same settings as Internet Explorer.

  • Deny all add-ons unless specifically allowed in the Add-on List
  • Add-on List
  • Process List
  • All Processes

ADM File: inetres.adm


Deny all add-ons unless specifically allowed in the Add-on List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Add-on Management\

Description:
This policy setting allows you to ensure that any Internet Explorer add-ons not listed in the 'Add-on List' policy setting are denied.

By default, the 'Add-on List' policy setting defines a list of add-ons to be allowed or denied through Group Policy. However, users can still use the Add-on Manager within Internet Explorer to manage add-ons not listed within the 'Add-on List' policy setting. This policy setting effectively removes this option from users - all add-ons are assumed to be denied unless they are specifically allowed through the 'Add-on List' policy setting.

If you enable this policy setting, Internet Explorer only allows add-ins that are specifically listed (and allowed) through the 'Add-on List' policy setting.

If you disable or do not configure this policy setting, users may use Add-on Manager to allow or deny any add-ons that are not included in the 'Add-on List' policy setting.

Note

  • If an add-on is listed in the 'Add-on List' policy setting, the user cannot change its state through Add-on Manager (unless its value has been set to allow user management - see the 'Add-on List' policy for more details).

ADM File: inetres.adm


Add-on List

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Add-on Management\

Description:
This policy setting allows you to manage a list of add-ons to be allowed or denied by Internet Explorer.

This list can be used with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting, which defines whether add-ons not listed here are assumed to be denied.

If you enable this policy setting, you can enter a list of add-ons to be allowed or denied by Internet Explorer. For each entry that you add to the list, enter the following information:

Name of the Value - the CLSID (class identifier) for the add-on you wish to add to the list. The CLSID should be in brackets for example, ‘{000000000-0000-0000-0000-0000000000000}’. The CLSID for an add-on can be obtained by reading the OBJECT tag from a Web page on which the add-on is referenced.

Value - A number indicating whether Internet Explorer should deny or allow the add-on to be loaded. To specify that an add-on should be denied enter a 0 (zero) into this field. To specify that an add-on should be allowed, enter a 1 (one) into this field. To specify that an add-on should be allowed and also permit the user to manage the add-on through Add-on Manager, enter a 2 (two) into this field.

If you disable this policy setting, the list is deleted. The 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting will still determine whether add-ons not in this list are assumed to be denied.

ADM File: inetres.adm


Network Protocol Lockdown

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown

Description:
In Windows Explorer, Internet Explorer, or any other process which opts into the security restriction, Network Protocol Lockdown may be implemented in any security zone in order to prevent active content obtained through restricted protocols from running in an unsafe manner, if the target URL is in that zone. Each zone may be set to either prompt the user when such content attempts to run, or to simply disallow the content in that zone.

  • Internet Explorer Processes
  • Process List
  • All Processes
  • Restricted Protocols Per Security Zone

ADM File: inetres.adm


Restricted Protocols Per Security Zone

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone

Description:
The list of restricted protocols governed by Network Protocol Lockdown varies per security zone. Use these policies to set the restricted protocol list for each zone.

If policy is set in both Computer Configuration and User Configuration, the two lists are combined.

  • Internet Zone Restricted Protocols
  • Intranet Zone Restricted Protocols
  • Trusted Sites Zone Restricted Protocols
  • Restricted Sites Zone Restricted Protocols
  • Local Machine Zone Restricted Protocols

ADM File: inetres.adm


Internet Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Intranet Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Trusted Sites Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Restricted Sites Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Local Machine Zone Restricted Protocols

Requirements: at least Internet Explorer v6.0 in Windows XP Service Pack 2

Location: Computer Configuration\Windows Components\Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone\

Description:
For each zone, the Network Protocol Lockdown security restriction may be configured to prevent active content obtained through restricted protocols from running in an unsafe manner, either by prompting the user, or simply disabling the content. For each zone, this list of protocols may be configured here, and applies to all processes which have opted in to the security restriction.

If you enable this policy setting for a zone, this sets the list of protocols to be restricted if that zone is set to Prompt or Disable for "Allow active content over restricted protocols to access my computer."

If you disable or do not configure this policy setting for a zone, no protocols are restricted for that zone, regardless of the setting for "Allow active content over restricted protocols to access my computer."

Note. If policy for a zone is set in both Computer Configuration and User Configuration, both lists of protocols will be restricted for that zone.

ADM File: inetres.adm


Administrative Templates Help

 Group Policy Admin Templates

Group Policy settings for Internet Explorer

ADM File: inetres.adm

Welcome to the administrative template help for Group Policy. Also see the main Group Policy help.

  • Computer Configuration
  • User Configuration