Click to return to the Security     
URL Security Zones Overvi...     URL Security Zones Refere...     URL Security Zones Overvi...    
Web Workshop  |  Security & Cryptography

URL Security Zones Templates


Microsoft® Internet Explorer 4.0 and later versions provide users with a set of templates that they can use to determine the level of security they want for a particular URL security zone. For more information on URL security zones, see the About URL Security Zones section of URL Security Zones Overview.

The URL security zone templates provide different levels of security. The High template contains settings that provide the highest level of security by restricting Web sites from doing potentially damaging operations. The Low template, on the other hand, contains the settings that provide the lowest level of security, allowing Web sites more access to the user's system.

When URL security zones was introduced in Internet Explorer 4.0, there were three default templates (High, Medium, and Low). Beginning with Internet Explorer 5, a fourth template, Medium-Low, was added.

The following list contains links to the templates that are used by Internet Explorer.

Currently, the settings for each of the default templates are stored in the registry. For more information about the registry keys used, see the Registry Keys section below.

High Template

The High template is used for URL security zones that contain Web sites that could cause damage to you computer or data. The settings used by this template will restrict sites from doing potentially damaging operations. By default, the Restricted sites zone uses this template.

URL action URL policy
URLACTION_ACTIVEX_OVERRIDE_OBJECT_SAFETY URLPOLICY_DISALLOW
URLACTION_ACTIVEX_RUN URLPOLICY_DISALLOW
URLACTION_CHANNEL_SOFTDIST_PERMISSIONS URLPOLICY_CHANNEL_SOFTDIST_PROHIBIT
URLACTION_COOKIES URLPOLICY_DISALLOW
URLACTION_COOKIES_SESSION URLPOLICY_DISALLOW
URLACTION_CREDENTIALS_USE URLPOLICY_CREDENTIALS_MUST_PROMPT_USER
URLACTION_CROSS_DOMAIN_DATA URLPOLICY_DISALLOW
URLACTION_DOWNLOAD_SIGNED_ACTIVEX URLPOLICY_DISALLOW
URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URLPOLICY_DISALLOW
URLACTION_HTML_FONT_DOWNLOAD URLPOLICY_QUERY
URLACTION_HTML_SUBFRAME_NAVIGATE URLPOLICY_DISALLOW
URLACTION_HTML_SUBMIT_FORMS URLPOLICY_QUERY
URLACTION_HTML_USERDATA_SAVE URLPOLICY_DISALLOW
URLACTION_JAVA_PERMISSIONS URLPOLICY_JAVA_HIGH
URLACTION_SCRIPT_JAVA_USE URLPOLICY_DISALLOW
URLACTION_SCRIPT_PASTE URLPOLICY_DISALLOW
URLACTION_SCRIPT_RUN URLPOLICY_ALLOW
URLACTION_SCRIPT_SAFE_ACTIVEX URLPOLICY_DISALLOW
URLACTION_SHELL_FILE_DOWNLOAD URLPOLICY_DISALLOW
URLACTION_SHELL_INSTALL_DTITEMS URLPOLICY_DISALLOW
URLACTION_SHELL_MOVE_OR_COPY URLPOLICY_QUERY
URLACTION_SHELL_VERB URLPOLICY_DISALLOW

The following table contains the URL actions whose URL policy was changed in Internet Explorer 5. Next to each URL action is the the URL policy assigned by the Internet Explorer 4.0 version of this template.

URL action URL policy
URLACTION_HTML_SUBMIT_FORMS URLPOLICY_DISALLOW
URLACTION_SHELL_MOVE_OR_COPY URLPOLICY_DISALLOW

Medium Template

The Medium template is used for URL security zones that contain Web sites that are neither trusted nor untrusted. By default, the Internet zone uses this template.

URL action URL policy
URLACTION_ACTIVEX_OVERRIDE_OBJECT_SAFETY URLPOLICY_DISALLOW
URLACTION_ACTIVEX_RUN URLPOLICY_ALLOW
URLACTION_CHANNEL_SOFTDIST_PERMISSIONS URLPOLICY_CHANNEL_SOFTDIST_PRECACHE
URLACTION_COOKIES URLPOLICY_ALLOW
URLACTION_COOKIES_SESSION URLPOLICY_ALLOW
URLACTION_CREDENTIALS_USE URLPOLICY_CREDENTIALS_MUST_PROMPT_USER
URLACTION_CROSS_DOMAIN_DATA URLPOLICY_DISALLOW
URLACTION_DOWNLOAD_SIGNED_ACTIVEX URLPOLICY_QUERY
URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URLPOLICY_DISALLOW
URLACTION_HTML_FONT_DOWNLOAD URLPOLICY_ALLOW
URLACTION_HTML_SUBFRAME_NAVIGATE URLPOLICY_ALLOW
URLACTION_HTML_SUBMIT_FORMS URLPOLICY_QUERY
URLACTION_HTML_USERDATA_SAVE URLPOLICY_ALLOW
URLACTION_JAVA_PERMISSIONS URLPOLICY_JAVA_HIGH
URLACTION_SCRIPT_JAVA_USE URLPOLICY_ALLOW
URLACTION_SCRIPT_PASTE URLPOLICY_ALLOW
URLACTION_SCRIPT_RUN URLPOLICY_ALLOW
URLACTION_SCRIPT_SAFE_ACTIVEX URLPOLICY_ALLOW
URLACTION_SHELL_FILE_DOWNLOAD URLPOLICY_ALLOW
URLACTION_SHELL_INSTALL_DTITEMS URLPOLICY_QUERY
URLACTION_SHELL_MOVE_OR_COPY URLPOLICY_ALLOW
URLACTION_SHELL_VERB URLPOLICY_QUERY

The following table contains the URL actions whose URL policy has changed in Internet Explorer 5. Next to each URL action is the the URL policy assigned by the Internet Explorer 4.0 version of this template.

URL action URL policy
URLACTION_ACTIVEX_OVERRIDE_OBJECT_SAFETY URLPOLICY_QUERY
URLACTION_SHELL_FILE_DOWNLOAD URLPOLICY_QUERY
URLACTION_SHELL_MOVE_OR_COPY URLPOLICY_QUERY

Medium-Low Template

The Medium-Low template is used for URL security zones that contain Web sites that are unlikely to cause damage to your computer or data. By default, the Intranet zone uses this template.

URL action URL policy
URLACTION_ACTIVEX_OVERRIDE_OBJECT_SAFETY URLPOLICY_DISALLOW
URLACTION_ACTIVEX_RUN URLPOLICY_ALLOW
URLACTION_CHANNEL_SOFTDIST_PERMISSIONS URLPOLICY_CHANNEL_SOFTDIST_PRECACHE
URLACTION_COOKIES URLPOLICY_ALLOW
URLACTION_COOKIES_SESSION URLPOLICY_ALLOW
URLACTION_CREDENTIALS_USE URLPOLICY_CREDENTIALS_SILENT_LOGON_OK
URLACTION_CROSS_DOMAIN_DATA URLPOLICY_QUERY
URLACTION_DOWNLOAD_SIGNED_ACTIVEX URLPOLICY_QUERY
URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URLPOLICY_DISALLOW
URLACTION_HTML_FONT_DOWNLOAD URLPOLICY_ALLOW
URLACTION_HTML_SUBFRAME_NAVIGATE URLPOLICY_ALLOW
URLACTION_HTML_SUBMIT_FORMS URLPOLICY_ALLOW
URLACTION_HTML_USERDATA_SAVE URLPOLICY_ALLOW
URLACTION_JAVA_PERMISSIONS URLPOLICY_JAVA_MEDIUM
URLACTION_SCRIPT_JAVA_USE URLPOLICY_ALLOW
URLACTION_SCRIPT_PASTE URLPOLICY_ALLOW
URLACTION_SCRIPT_RUN URLPOLICY_ALLOW
URLACTION_SCRIPT_SAFE_ACTIVEX URLPOLICY_ALLOW
URLACTION_SHELL_FILE_DOWNLOAD URLPOLICY_ALLOW
URLACTION_SHELL_INSTALL_DTITEMS URLPOLICY_ALLOW
URLACTION_SHELL_MOVE_OR_COPY URLPOLICY_ALLOW
URLACTION_SHELL_VERB URLPOLICY_ALLOW

Low Template

The Low template is used for URL security zones that contain Web sites that are fully trusted by the user. By default, the Trusted sites zone uses this template.

URL action URL policy
URLACTION_ACTIVEX_OVERRIDE_OBJECT_SAFETY URLPOLICY_QUERY
URLACTION_ACTIVEX_RUN URLPOLICY_ALLOW
URLACTION_CHANNEL_SOFTDIST_PERMISSIONS URLPOLICY_CHANNEL_SOFTDIST_AUTOINSTALL
URLACTION_COOKIES URLPOLICY_ALLOW
URLACTION_COOKIES_SESSION URLPOLICY_ALLOW
URLACTION_CREDENTIALS_USE URLPOLICY_CREDENTIALS_SILENT_LOGON_OK
URLACTION_CROSS_DOMAIN_DATA URLPOLICY_ALLOW
URLACTION_DOWNLOAD_SIGNED_ACTIVEX URLPOLICY_ALLOW
URLACTION_DOWNLOAD_UNSIGNED_ACTIVEX URLPOLICY_QUERY
URLACTION_HTML_FONT_DOWNLOAD URLPOLICY_ALLOW
URLACTION_HTML_SUBFRAME_NAVIGATE URLPOLICY_DISALLOW
URLACTION_HTML_SUBMIT_FORMS URLPOLICY_ALLOW
URLACTION_HTML_USERDATA_SAVE URLPOLICY_ALLOW
URLACTION_JAVA_PERMISSIONS URLPOLICY_JAVA_LOW
URLACTION_SCRIPT_JAVA_USE URLPOLICY_ALLOW
URLACTION_SCRIPT_PASTE URLPOLICY_ALLOW
URLACTION_SCRIPT_RUN URLPOLICY_ALLOW
URLACTION_SCRIPT_SAFE_ACTIVEX URLPOLICY_ALLOW
URLACTION_SHELL_FILE_DOWNLOAD URLPOLICY_ALLOW
URLACTION_SHELL_INSTALL_DTITEMS URLPOLICY_ALLOW
URLACTION_SHELL_MOVE_OR_COPY URLPOLICY_ALLOW
URLACTION_SHELL_VERB URLPOLICY_ALLOW

The following table contains the URL actions whose URL policy has changed in Internet Explorer 5. Next to each URL action is the the URL policy assigned by the Internet Explorer 4.0 version of this template.

URL action URL policy
URLACTION_SHELL_FILE_DOWNLOAD URLPOLICY_QUERY
URLACTION_SHELL_VERB URLPOLICY_QUERY

Registry Keys

Currently, the settings for each template are stored in the registry under the following keys:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\TemplatePolicies

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Internet Settings\TemplatePolicies

The information under these registry keys should be used for reference only. Future versions of Internet Explorer may not use the registry to store template information, so developers should not directly manipulate the registry.



Back to topBack to top

Did you find this topic useful? Suggestions for other topics? Write us!

© 1999 Microsoft Corporation. All rights reserved. Terms of use.