Internet Explorer URL Action and Advanced Security Settings in Group Policy

Applies To: Windows Server 2003 with SP1

Windows XP Service Pack 2 introduced true policies for the configurable actions in the Internet Explorer Security tab settings. In addition to incorporating these policies into Internet Explorer in Windows Server 2003 Service Pack 1, additional policies were created for selected configurable actions in the Internet Explorer Advanced tab, as well as for URL action policies in Locked-Down zones used only by the Network Protocol Lockdown security feature. In this release, these security settings are managed using the Group Policy Management Console and, if set, can only be changed by a Group Policy object (GPO) or by an administrator.

An updated Inetres.adm file contains a list of settings as policies, including Advanced settings, which are also found in the Internet Explorer user interface as preferences. Administrators can manage the new feature control policies by using Group Policy objects (GPOs). When Internet Explorer is installed, the default HKEY_CURRENT_USER preferences settings for these settings are registered on the computer as they were in previous versions. The Administrator has to use the Group Policy Management Console (GPMC) to add these settings as policies.

Group Policy administrators can uniformly configure the new Internet Explorer Advanced setting policies, as well as policies for Locked-Down security zones, for the computers and users that they manage. It is important to inform the end-user which actions are controlled by policy, as these actions will override user preference settings.

The following definitions apply to Internet Explorer settings for Windows Server 2003 with Service Pack 1:

• Security zones: Locked-Down Intranet Zone, Locked-Down Trusted Sites Zone, Locked-Down Internet Zone, and Locked-Down Restricted Sites zone.

• Templates: Standard settings for all URL actions in these security zones. Templates can be applied in any zone, and settings will provide a range of choices from low security, medium-low, medium, and up to high security for the zone.

• URL actions: Security settings in the registry that identify the action to take for that feature in the security zone where the URL resides. URL action settings include enable, disable, prompt, and others as appropriate.

• URL action policies: URL action policies can be added individually by enabling the desired URL action policy, then selecting the setting for the policy registry key value. They can also be set by zone template.

Internet Explorer will look for a policy in the following order:

• HKEY_LOCAL_MACHINE policy hive

• HKEY_CURRENT_USER policy hive

• HKEY_CURRENT_USER preference hive

• HKEY_LOCAL_MACHINE preference hive

If Internet Explorer finds a policy in the HKEY_LOCAL_MACHINE policy hive, it stops and does not continue; that is the setting it respects. If Internet Explorer does not find a policy in HKEY_LOCAL_MACHINE policy hive, it looks in the HKEY_CURRENT_USER policy hive, and so on. The administrator can set a policy for one or more URL actions in one or more zones, and allow the end user to manage preferences for URL actions that do not require policy-level security management.

The new URL action policies have the same numeric values as their related preference keys. The following table provides a reference to these URL actions.

For more information about using URL action flags, see "URL Action Flags" on the MSDN Web site at https://go.microsoft.com/fwlink/?LinkId=32776.

The following table provides a reference to the setting options available for each URL action.

For descriptions for each of the URL policy settings, see "URL Action Flags" on the MSDN Web site at https://go.microsoft.com/fwlink/?LinkId=32777.

Each URL action has a default that is set in each zone and set when a specified template is applied. The default settings for each zone are described in the following table.

These paths locate the available Advanced settings in the Group Policy Management Console:

• HKEY_LOCAL_MACHINE policies for Advanced settings:

\Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page

• HKEY_CURRENT_USER policies for Advanced settings:

\User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Advanced Page

These paths locate the security zone settings in the Group Policy Management Console:

• HKEY_LOCAL_MACHINE policies by security zone for URL actions:

\Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page

• HKEY_CURRENT_USER policies by security zone for URL actions:

\User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page

These paths locate the Advanced settings in policy and in preference in the Windows registry (in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER):

These paths locate the security zone settings in policy and in preference in the Windows registry (in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER):

• Location of Locked-Down Intranet zone policy values:

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1

• Location of Locked-Down Trusted Sites policy:

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2

• Location of Locked-Down Internet zone policy values:

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3

• Location of Locked-Down Restricted Sites policy values:

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4

• Location of Locked-Down Intranet zone template:

Software\Policies\Microsoft\Windows\CurrentVersion\Intranet Lockdown Settings

• Location of Locked-Down Trusted Sites template:

Software\Policies\Microsoft\Windows\CurrentVersion\Trusted Sites Lockdown Settings

• Location of Locked-Down Internet zone template:

Software\Policies\Microsoft\Windows\CurrentVersion\Internet Lockdown Settings

• Location of Locked-Down Restricted Sites template:

Software\Policies\Microsoft\Windows\CurrentVersion\Restricted Sites Lockdown Settings

Group Policy is the recommended tool for managing Internet Explorer for client computers on a corporate network. Internet Explorer supports Group Policy management for all new Internet Explorer Feature Controls in Windows Server 2003 Service Pack 1, and for Security page settings or URL actions. Administrators of Group Policy can manage these new policy settings in the Administrative Templates extension of the Group Policy Management Console.

When implementing policy settings, it is recommended that you configure template policy settings in one Group Policy object (GPO) and configure any related individual policy settings in a separate GPO. You can then use Group Policy management features (for example, precedence, inheritance, or enforce) to apply individual settings to specific client computers.

Policies can be read by users but can only be changed by via Group Policy management or by an administrator. Preference settings can be changed programmatically, by editing the registry, or in the case of URL actions, by using Internet Explorer. Settings specified by Group Policy take precedence over settings specified using preferences.

By adding the new Advanced setting policies and Locked-Down security policies to Group Policy, administrators can manage these true policies to establish standard settings for all the computers that they configure. The administrator can control these settings in such a way that they cannot be changed except through Group Policy or by a user with administrator privileges, thus ensuring that security and certain Advanced settings are not set by end users.

Windows Server 2003 Service Pack 1 adds new policies to Group Policy but does not change how policies are managed. Developers need to be aware of how each Feature Control and URL action setting or setting combination affects security-related behavior for their applications in each security zone.

For greater security, the administrator should enable policies for all zones, so that there is a known configuration set by policy rather than an unknown setting read from HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER preference settings not set by policy. If the administrator sets policies for all zones, we recommend that the policy to disable the Security page be enabled, which will make the user interface in Internet Explorer unavailable.

The administrator should also understand the Feature Control policy settings. Some of the URL action settings will not be valid unless the corresponding Feature Control policy is enabled. Internet Explorer checks to see whether the feature is enabled, and if it is, then looks for the setting for the action based on the security zone of the URL.

The method for adding Zone Map keys to policy is as follows:

1. To set computer policy, go to \Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page within Group Policy. To set user policy, go to \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page within Group Policy.

2. Select the Site to Zone Assignment List policy.

3. Select Enabled and click Show…

4. For each site you would like to map:

   1. Click Add…

   2. Enter the name, IP address, or IP range of the site you want to map (for example, https://www.contoso.com, www.contoso.com, 127.0.0.1, 127.0.0.1-10)

   3. Enter the value identifying the zone to which this site should be mapped. The choices are (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, (4) Restricted Sites zone.

   4. Click OK.

   5. The site name and value should appear in the list.

5. Click OK in the Show Contents window.

6. Click OK again to close the Site to Zone Assignment List Properties window.

   Note

   Policies created by following these instructions are ignored by computers with the Windows Server 2003 Internet Explorer Enhanced Security Configuration component installed. To set zone map policy on a computer with Windows Server 2003 Internet Explorer Enhanced Security Configuration component installed, use the Internet Explorer Maintenance (IEM) snap-in to Group Policy. When using the IEM to create a Group Policy object to apply to a computer with the Windows Server 2003 Internet Explorer Enhanced Security Configuration component installed, you must be using a computer with the Windows Server 2003 Internet Explorer Enhanced Security Configuration component installed.