7

Okay, now to be clear, I am not talking about enabling or disabling protected mode in general across the board for IE. I am talking about doing so on a per security zone basis using only registry. In other words like just for the Intranet Zone.

So yes, I already know about tab proc growth = 0, but this disables protected mode and puts all of the IE tab processes in the same process.

What I am talking about:

enter image description here

Essentially I am asking this question, but I would like the answer in the form of a registry key instead of a group policy.

13

I inspected the ADMX files (Group Policy setting definitions) to figure out the structure of these data; the relevant settings are in inetres.admx in \Windows\PolicyDefinitions.

These settings are stored in HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones. Under Zones is a subkey for each zone, named numerically:

  • 0 is the Local Machine zone
  • 1 is the Intranet zone
  • 2 is the Trusted Sites zone
  • 3 is the Internet zone
  • 4 is the Restricted Sites zone

(There can also be a Lockdown_Zones subkey under Internet Settings that applies - you guessed it - to the locked down version of the corresponding zone.)

Under each numerically-named key, you can create or set a REG_DWORD value named 2500 to contol whether Protected Mode is enabled for the zone. Setting that value to 0 enables Protected Mode; a setting of 3 disables it.

So, to enable Protected Mode for the Internet zone, set this entry to 0:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500

If you want to read/write the policy version of these settings: The Group Policy settings shown in the question and answer you linked are, like the vast majority of Group Policy options, implemented as Registry entries. Policy entries are stored in HKCU\Software\Policies (for a single user) or HKLM\SOFTWARE\Policies (for the machine). Under Policies, Microsoft\Windows\CurrentVersion\Internet Settings\Zones is exactly as described earlier, but will not allow the user to change the settings. Per-user policy cannot be modified by programs running as that user, unless the user is an administrator.

1

To enable protected mode (tick the box as you requested) set the HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Main key to "Isolation"="PMEM".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.