Microsoft Windows Registry Guide, Second Edition

Internet Explorer Security Zones

Internet Explorer security zones settings are stored in HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings and HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings. By default, security zones settings are stored in HKCU. The settings for one user do not affect the settings for another. The Internet Settings key has the following subkeys:

If the Security Zones: Use only machine settings setting in Group Policy is enabled, or if the Security_HKLM_only REG_DWORD value is present and has a value of 1 in HLKM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings, only local computer settings are used and all users have the same security settings. With the Security_HKLM_only policy enabled, HKLM values will be used by Internet Explorer, but the HKCU values will still be displayed in the zone settings on the Security tab in Internet Explorer. This is by design and there are no plans to change this functionality. If the Security Zones: Use only machine settings setting is not enabled in Group Policy, or if the Security_HKLM_only REG_DWORD value does not exist or is set to 0, computer settings are used along with user settings. However, only user settings appear in Internet Options. For example, when this REG_DWORD value does not exist or is set to 0, HKLM settings are read along with HKCU settings, but only HKCU settings appear in the Internet Options.

TemplatePolicies

The TemplatePolicies key determines the settings of the default security zone levels (Low, Medium Low, Medium, and High). You can change the security level settings from the default settings. However, you cannot add additional security levels. The keys contain values that determine the setting for the security zone. Each key contains a Description string value and a Display Name string value that determine the text that appears on the Security tab for each security level.

ZoneMap

The ZoneMap key contains the following keys:

NOTE

Because arbitrarily named keys are processed in the order that they were added to the registry, this method might find a random match before it finds an exact match. If so, the URL might be executed in a different security zone than the zone where it is typically assigned. This behavior is by design.

Zones

The Zones key contains keys that represent each security zone that is defined for the computer. By default, the following five zones are defined (numbered zero through four):

NOTE

By default, My Computer does not appear in the Zone box on the Security tab.

Each of these keys contains the following REG_DWORD values that represent corresponding settings on the custom Security tab:

Unless stated otherwise, each REG_DWORD value is equal to zero, one, or three. Typically, a setting of zero sets a specific action as permitted, a setting of one causes a prompt to appear, and a setting of three does not allow the specific action.

Each security zone also contains the Description string value and the Display Name string value. The text of these values appears on the Security tab when you click a zone in the Zone box. There is also an Icon string value that sets the icon that appears for each zone. Except for the My Computer zone, each zone contains a CurrentLevel, a MinLevel, and a RecommendedLevel REG_DWORD value. The MinLevel value sets the lowest setting that can be used before you receive a warning message, CurrentLevel is the current setting for the zone, and RecommendedLevel is the recommended level for the zone. The following list describes the settings for these values:

The Flags REG_DWORD value determines the ability of the user to modify the security zone's properties. To determine the Flags value, add the numbers of the appropriate settings together. The following Flags values are available:

Related

Категории